CVE-2024-12166: Shortcodes Blocks Creator Ultimate XSS

CVE-2024-12166 Overview

CVE-2024-12166 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Shortcodes Blocks Creator Ultimate plugin for WordPress. The flaw affects all versions up to and including 2.2.0. The plugin fails to sanitize input or escape output for the page parameter, allowing unauthenticated attackers to inject arbitrary JavaScript. Successful exploitation requires user interaction, such as clicking a crafted link. The NVD entry notes that CVE-2024-54264 may be a duplicate of this issue. This vulnerability is classified under [CWE-79], Improper Neutralization of Input During Web Page Generation.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session, potentially hijacking WordPress administrator accounts or performing actions on their behalf.

Affected Products

Cmorillas1 Shortcodes Blocks Creator Ultimate plugin for WordPress
All versions up to and including 2.2.0
WordPress sites with the ultimate-shortcodes-creator plugin installed and activated

Discovery Timeline

2024-12-07 - CVE-2024-12166 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12166

Vulnerability Analysis

The vulnerability resides in the plugin's administrative interface, specifically in the shortcode list table implementation at admin/class-shortcode-list-table.php. The page query parameter passed through the WordPress admin URL is reflected back into the rendered HTML output without proper sanitization or escaping.

Attackers can craft a URL containing malicious JavaScript in the page parameter and deliver it to an authenticated WordPress user, typically an administrator. When the target clicks the link, the injected script executes within the context of the WordPress admin interface.

The scope-changed nature of this reflected XSS means injected scripts can affect resources beyond the vulnerable component's security scope. This enables session token theft, forced administrative actions, and secondary payload delivery through the trusted admin origin.

Root Cause

The root cause is missing input validation and output encoding on the page GET parameter. The plugin echoes the parameter value into HTML attributes or the page body without applying WordPress's esc_attr(), esc_html(), or sanitize_text_field() functions. The WordPress Plugin Code Reference shows the affected code location.

Attack Vector

Exploitation follows a standard reflected XSS pattern. An attacker crafts a URL targeting the vulnerable plugin admin page and appends a malicious payload to the page parameter. The attacker then uses phishing, forum posts, or malicious advertisements to induce an authenticated WordPress user to click the link. Upon page load, the browser renders the reflected payload and executes attacker-controlled JavaScript within the site's origin.

For full technical details, see the Wordfence Vulnerability Report.

Detection Methods for CVE-2024-12166

Indicators of Compromise

HTTP requests to /wp-admin/admin.php containing suspicious characters such as <script>, javascript:, onerror=, or URL-encoded equivalents (%3Cscript%3E) in the page parameter
Referer headers pointing to external phishing domains that link into WordPress admin URLs
Unexpected outbound requests from administrator browser sessions to attacker-controlled infrastructure
Unauthorized changes to WordPress user accounts, plugin settings, or content immediately following administrator activity

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect query string parameters for XSS payloads targeting /wp-admin/ endpoints
Enable WordPress access logging and alert on requests containing HTML tags or JavaScript event handlers in URL parameters
Perform version fingerprinting of installed plugins to identify Shortcodes Blocks Creator Ultimate at version 2.2.0 or earlier

Monitoring Recommendations

Correlate administrator login events with subsequent admin panel URL access patterns
Monitor for creation of new administrative users or modification of privileged accounts
Track browser telemetry for anomalous script execution within /wp-admin/ origins
Ingest WordPress and web server logs into a centralized SIEM for retrospective hunting on the page parameter

How to Mitigate CVE-2024-12166

Immediate Actions Required

Identify all WordPress instances with the Shortcodes Blocks Creator Ultimate plugin installed
Deactivate the plugin on any site running version 2.2.0 or earlier until a patched release is available
Force password resets for administrator accounts if suspicious activity is observed
Review recent admin actions and audit logs for unauthorized changes

Patch Information

At the time of the NVD entry, no vendor-supplied patch is referenced. Administrators should monitor the WordPress plugin repository for updates beyond version 2.2.0 and apply them as soon as they become available. If no patched version is released, consider permanent removal of the plugin.

Workarounds

Remove or disable the plugin entirely if a patched version is not available
Deploy WAF rules to block requests containing script tags or JavaScript event handlers in the page query parameter
Restrict access to /wp-admin/ by IP allowlist to reduce the attack surface for phishing-delivered payloads
Enforce Content Security Policy (CSP) headers that block inline script execution in the admin interface

bash

# Example nginx rule to block suspicious page parameter values
if ($args ~* "page=.*(<|%3C)script") {
    return 403;
}