CVE-2024-12167: Shortcodes Blocks Creator Ultimate XSS Flaw

CVE-2024-12167 Overview

CVE-2024-12167 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Shortcodes Blocks Creator Ultimate plugin for WordPress. The flaw affects all versions up to and including 2.2.0. It exists in the handling of the _wpnonce parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a victim clicks a crafted link. The vulnerability is tracked under CWE-79 and affects plugin installations distributed by cmorillas1.

Critical Impact
Successful exploitation lets unauthenticated attackers execute arbitrary JavaScript in the victim's browser session, enabling session theft, administrative action hijacking, and redirection to malicious content.

Affected Products

Shortcodes Blocks Creator Ultimate for WordPress — all versions through 2.2.0
Vendor: cmorillas1
Component: cmorillas1:shortcodes_blocks_creator_ultimate

Discovery Timeline

2024-12-07 - CVE-2024-12167 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12167

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting flaw in the plugin's admin handling code. The plugin reads the _wpnonce request parameter and echoes it back into the rendered page without applying sanitization or output escaping. Because WordPress nonces are typically treated as trusted values, developers frequently forget to escape them when reflected in HTML context. An attacker can substitute the nonce value with a JavaScript payload, and the plugin reflects that payload verbatim into the response body.

The issue resides in the plugin's admin class, referenced in the WordPress plugin repository at admin/class-admin.php around line 111.

Root Cause

The root cause is missing input sanitization and missing output escaping on the _wpnonce request parameter. WordPress provides helpers such as esc_attr(), esc_html(), and wp_kses() that neutralize HTML control characters before rendering user-controlled data. The affected code path omits these calls, allowing raw request data to reach the HTML output context. This is a textbook CWE-79 improper neutralization of input during web page generation.

Attack Vector

The attack requires user interaction. An attacker crafts a URL to a vulnerable WordPress site that includes a malicious _wpnonce value containing JavaScript. The attacker delivers this URL through phishing, social media, or a compromised page. When an authenticated administrator or editor clicks the link, the browser loads the page and executes the injected script in the site's origin. The script can then perform actions on behalf of the victim, exfiltrate cookies, or pivot to further attacks. The vulnerability requires no authentication on the attacker's side.

No verified public proof-of-concept code is available. See the Wordfence Vulnerability Report and the WordPress Plugin Source Code for technical references.

Detection Methods for CVE-2024-12167

Indicators of Compromise

Web server access logs showing requests to plugin admin URLs containing HTML tags or JavaScript in the _wpnonce query parameter, for example %3Cscript%3E or onerror= fragments.
Referrer headers from external phishing domains pointing to authenticated WordPress admin endpoints.
Unexpected outbound requests from browser sessions of WordPress administrators to attacker-controlled hosts shortly after visiting the site.

Detection Strategies

Inspect HTTP request logs for _wpnonce values that exceed normal nonce length (10 characters) or contain non-alphanumeric characters.
Deploy a Web Application Firewall (WAF) rule that blocks requests containing <script, javascript:, or common event handlers within any _wpnonce parameter.
Run periodic plugin inventory scans and cross-reference installed plugin versions against the fixed release for Shortcodes Blocks Creator Ultimate.

Monitoring Recommendations

Enable verbose logging on the WordPress reverse proxy or WAF and alert on parameter payloads matching XSS signatures.
Monitor browser telemetry from administrative workstations for unexpected script execution or cookie access originating from the WordPress admin domain.
Track plugin update status across all managed WordPress instances and generate alerts for outdated Shortcodes Blocks Creator Ultimate installations.

How to Mitigate CVE-2024-12167

Immediate Actions Required

Update Shortcodes Blocks Creator Ultimate to a version newer than 2.2.0 as soon as the vendor publishes a fixed release.
If no patched version is available, deactivate and remove the plugin from all WordPress installations.
Instruct administrators and editors to avoid clicking untrusted links that point to the WordPress admin interface.

Patch Information

At the time of the last NVD update, all versions through 2.2.0 remain affected. Consult the Wordfence Vulnerability Report and the plugin listing on WordPress.org for the current patched version. Apply the vendor update through the WordPress admin dashboard or via wp-cli once released.

Workarounds

Deploy a WAF rule that filters requests containing script tags or JavaScript event handlers in the _wpnonce parameter.
Restrict access to the WordPress admin interface by IP allowlist at the web server or reverse proxy layer.
Enforce a strict Content Security Policy (CSP) that disallows inline script execution on admin pages to reduce the impact of reflected payloads.

bash

# Example: block obvious XSS payloads in _wpnonce at the nginx layer
if ($arg__wpnonce ~* "(<|%3C)script|javascript:|onerror=|onload=") {
    return 403;
}