CVE-2024-51638: Genesis Awesome Shortcodes CSRF Vulnerability

CVE-2024-51638 Overview

CVE-2024-51638 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the Sanjeev Mohindra Awesome Shortcodes For Genesis WordPress plugin. The flaw affects all versions of the plugin up to and including 1.1.8. An attacker can chain the CSRF weakness with a Stored Cross-Site Scripting (XSS) payload, allowing malicious JavaScript to be persisted in the WordPress site when an authenticated administrator is tricked into visiting an attacker-controlled page.

Critical Impact

Successful exploitation persists attacker-controlled JavaScript in the WordPress site, enabling session theft, administrative action abuse, and visitor compromise whenever the affected page is rendered.

Affected Products

• Awesome Shortcodes For Genesis WordPress plugin (awesome-shortcodes-for-genesis)
• All versions from n/a through 1.1.8
• WordPress installations using the Genesis Framework with this plugin enabled

Discovery Timeline

• 2024-11-19 - CVE-2024-51638 published to the National Vulnerability Database (NVD)
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-51638

Vulnerability Analysis

The vulnerability combines two distinct weaknesses into a single exploitation chain. The plugin exposes administrative actions that accept user-controlled input without verifying request authenticity through anti-CSRF tokens (WordPress nonces). The same input is later rendered in a page context without proper output encoding, producing a Stored XSS condition.

An attacker crafts a malicious web page that auto-submits a forged request to the target WordPress site. If a logged-in administrator visits that page, the browser sends the administrator's session cookies along with the forged request. The payload is saved and rendered as part of plugin output, executing JavaScript in the browser of any subsequent visitor.

This class of vulnerability is significant because it converts a phishing-style lure into persistent code execution within the trusted origin. Stored XSS in WordPress administrative contexts commonly leads to account takeover, plugin installation, and pivoting deeper into the hosting environment.

Root Cause

The plugin's request handlers do not validate WordPress nonces (wp_verify_nonce) on state-changing endpoints. Submitted shortcode configuration values are then stored and emitted into HTML output without contextual escaping such as esc_html, esc_attr, or wp_kses_post. The combined absence of CSRF protection and output sanitization produces the chained vulnerability.

Attack Vector

Exploitation requires user interaction from an authenticated WordPress administrator. The attacker hosts an HTML page containing a hidden form or fetch request targeting the vulnerable plugin endpoint on the victim's WordPress site. When the administrator browses to the attacker page, the request executes with the administrator's privileges, and the malicious script is persisted. The vulnerability is exploitable over the network and does not require credentials on the attacker side.

No verified proof-of-concept exploit code is publicly available. See the Patchstack XSS Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-51638

Indicators of Compromise

• Unexpected <script> tags, event handlers, or obfuscated JavaScript inside stored shortcode configurations in the WordPress database (wp_options, wp_postmeta).
• Outbound requests from visitor browsers to unfamiliar domains when pages using Genesis shortcodes are rendered.
• New administrator accounts or modified user roles appearing without a corresponding administrative action in audit logs.

Detection Strategies

• Review web server access logs for POST requests to plugin administrative endpoints that lack a valid Referer header matching the WordPress domain.
• Scan WordPress database tables for shortcode values containing HTML or JavaScript syntax such as onerror=, javascript:, or <script.
• Monitor for HTTP responses serving plugin-controlled content that contains script payloads not present in the plugin's default templates.

Monitoring Recommendations

• Enable WordPress audit logging to capture changes to plugin settings and administrator-initiated configuration updates.
• Deploy Content Security Policy (CSP) headers in report-only mode to surface unexpected inline script execution.
• Forward web application firewall (WAF) and WordPress event logs to a centralized analytics platform for correlation across sessions and source IPs.

How to Mitigate CVE-2024-51638

Immediate Actions Required

• Upgrade the Awesome Shortcodes For Genesis plugin to a release later than 1.1.8 once a patched version is published by the maintainer.
• Audit the WordPress database for stored shortcode entries containing JavaScript and remove malicious content.
• Rotate WordPress administrator credentials and invalidate active sessions if compromise is suspected.

Patch Information

At the time of publication, no fixed version is listed in the NVD entry or the Patchstack advisory. Site operators should monitor the Patchstack XSS Vulnerability Report and the official WordPress plugin repository for updates. If a patched release is not available, deactivate and remove the plugin.

Workarounds

• Deactivate and remove the awesome-shortcodes-for-genesis plugin until a vendor fix is released.
• Restrict administrative access to the WordPress dashboard by source IP using web server rules or a WAF.
• Enforce a strict Content Security Policy that disallows inline scripts to reduce the impact of Stored XSS payloads.
• Require administrators to use separate browser profiles for WordPress management to limit cross-site request exposure.

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate awesome-shortcodes-for-genesis
wp plugin delete awesome-shortcodes-for-genesis

# Audit postmeta for suspicious script content
wp db query "SELECT post_id, meta_key FROM wp_postmeta WHERE meta_value LIKE '%<script%' OR meta_value LIKE '%onerror=%';"