CVE-2024-12529
📋 TL;DR
This stored XSS vulnerability in the brodos.net Onlineshop Plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject malicious scripts into website pages. When users visit compromised pages, the scripts execute in their browsers, potentially stealing session cookies or redirecting to malicious sites. All WordPress sites using this plugin up to version 2.0.2 are affected.
💻 Affected Systems
- brodos.net Onlineshop Plugin for WordPress
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, deface websites, redirect users to phishing sites, or install backdoors for persistent access.
Likely Case
Attackers with contributor accounts inject malicious scripts to steal user session cookies or display unwanted content, potentially compromising user accounts.
If Mitigated
With proper access controls limiting contributor accounts and regular monitoring, impact is limited to minor content manipulation.
🎯 Exploit Status
Exploitation requires contributor-level WordPress access. The vulnerability is in the BrodosCategory shortcode attribute handling.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.3 or later
Vendor Advisory: https://plugins.trac.wordpress.org/browser/brodos-net-onlineshop
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'brodos.net Onlineshop Plugin'. 4. Click 'Update Now' if update is available. 5. Alternatively, download version 2.0.3+ from WordPress plugin repository and manually update.
🔧 Temporary Workarounds
Disable vulnerable shortcode
allRemove or disable the BrodosCategory shortcode from posts/pages
Edit WordPress posts/pages and remove [BrodosCategory] shortcode instances
Restrict contributor capabilities
allLimit contributor accounts from publishing or editing published content
Use WordPress role management plugins to modify contributor capabilities
🧯 If You Can't Patch
- Remove the brodos.net Onlineshop Plugin entirely if not essential
- Implement strict Content Security Policy (CSP) headers to mitigate XSS impact
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for brodos.net Onlineshop Plugin version 2.0.2 or earlierCheck Version:
wp plugin list --name='brodos-net-onlineshop' --field=version (if WP-CLI installed)Verify Fix Applied:
Verify plugin version is 2.0.3 or later in WordPress admin panel📡 Detection & Monitoring
Log Indicators:
- Unusual post/page edits by contributor accounts
- Suspicious shortcode modifications in content
Network Indicators:
- Unexpected JavaScript execution from WordPress pages
- Suspicious outbound connections from user browsers
SIEM Query:
source="wordpress" AND (event="post_modified" OR event="page_modified") AND user_role="contributor" AND content CONTAINS "[BrodosCategory"