CVE-2024-8103

Executive Summary

CVE-2024-8103 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Category Dropdown WordPress plugin, affecting all versions up to and including 1.8. The flaw resides in the align parameter, which is insufficiently sanitized and escaped. An authenticated attacker with at least Contributor-level privileges can inject arbitrary web scripts that execute when any user visits the compromised page. This is a WordPress ecosystem issue, not related to Apache or Nginx.

Given the low EPSS score (0.0%) and no known public exploits, the immediate threat is moderate but persistent. The vulnerability allows for persistent defacement, credential theft, or malware distribution within the WordPress site’s context.

Supply Chain & Package Security

This is a WordPress plugin, not an NPM, PyPI, Go, or Ruby package. No supply chain implications are present beyond the plugin’s update mechanism.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is Medium due to the requirement for authenticated access, but the potential for widespread impact on site visitors elevates the risk.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS in the align parameter of the WP Category Dropdown plugin. The plugin likely uses this parameter to control CSS alignment (e.g., left, center, right). Due to insufficient input sanitization and output escaping, an attacker can inject malicious JavaScript.

Attack Flow:

1. Attacker logs in with Contributor-level (or higher) credentials.
2. Attacker creates or edits a post/page and inserts the WP Category Dropdown shortcode.
3. Attacker sets the align parameter to a payload like left" onmouseover="alert(1) or center"><script>alert(document.cookie)</script>.
4. The payload is stored in the database.
5. When any user (including admins) visits the page, the script executes in their browser.

The vulnerability is in the output stage: the plugin fails to escape the align value before rendering it in HTML attributes or inline styles.

Vulnerable vs. Patched Code

Vulnerable Code (hypothetical, based on typical plugin structure):

// In shortcode handler
$align = isset($atts['align']) ? $atts['align'] : 'left';
echo '<div class="category-dropdown" style="text-align: ' . $align . ';">';

Patched Code (expected fix):

$align = isset($atts['align']) ? esc_attr($atts['align']) : 'left';
echo '<div class="category-dropdown" style="text-align: ' . esc_attr($align) . ';">';

The fix uses esc_attr() to escape the output, preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with WP Category Dropdown plugin <= 1.8
• Contributor-level account or higher

Exploitation Steps:

1. Log in as a Contributor.
2. Create a new post.
3. Insert the shortcode: [wp_category_dropdown align="center\"><script>alert('XSS')</script>"]
4. Publish the post.
5. Visit the post as any user to trigger the XSS.

Advanced Payload:

[wp_category_dropdown align="left\" onfocus=\"alert(document.cookie)\" autofocus=\"true"]

Blue Team (Detection & Hardening)

Detection:

• Monitor for posts/pages containing the shortcode [wp_category_dropdown with unusual align values.
• Look for align parameters containing <, >, ", or script in the database.

Hardening:

• Disable the plugin until a patch is available.
• Use a Web Application Firewall (WAF) to block XSS payloads in shortcode parameters.
• Restrict Contributor-level users from using shortcodes via user role editor plugins.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/wp-category-dropdown/wp-category-dropdown.php (version <= 1.8)
• Database: Posts/pages containing [wp_category_dropdown align= with suspicious characters.
• Network: Outbound connections to attacker-controlled domains from compromised pages.
• Logs: WordPress audit logs showing shortcode usage by Contributor-level users.

Detection Engineering

YARA Rule

rule CVE_2024_8103_WP_Category_Dropdown_XSS {
    meta:
        description = "Detects malicious align parameter in WP Category Dropdown shortcode"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-8103"
    strings:
        $shortcode = /\[wp_category_dropdown[^\]]*align\s*=\s*["'][^"']*[<>\"']/ nocase
        $xss_payload = /<script|<img|<svg|onerror|onload|onfocus|onmouseover/i
    condition:
        $shortcode and $xss_payload
}

Sigma Rule

title: CVE-2024-8103 WP Category Dropdown Stored XSS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS via align parameter in WP Category Dropdown plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: 'wp_category_dropdown'
        http.url|re: 'align=.*[<>\"\']'
    condition: selection
falsepositives:
    - Legitimate use of alignment values with special characters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-8103 WP Category Dropdown XSS Attempt"; flow:to_server,established; content:"wp_category_dropdown"; http_uri; pcre:"/align\s*=\s*["'][^"']*[<>\"']/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patched version is released.
2. Audit all posts/pages for malicious shortcode parameters.
3. Remove any injected content from the database.

Long-term Fix:

• Apply the vendor patch when available (expected to use esc_attr() on the align parameter).
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Regularly update all WordPress plugins.

Workarounds:

• Use a security plugin (e.g., Wordfence) to block XSS payloads.
• Restrict shortcode usage to Administrator-level users only.

Valters IT