# Behind the Code: Identifying Zero-Day Exploits in WordPress
## 1 Introduction  
The current status quo in cybersecurity faces significant challenges and limitations, particularly in the detection and mitigation of zero-day vulnerabilities. Traditional approaches, such as signature-based and heuristic-based methods, often fall short in identifying novel threats due to their reliance on known attack patterns. Signature-based methods detect malware by comparing the code against a database of known malware signatures. While effective for known threats, this method fails to detect new, unknown vulnerabilities [1]. Heuristic-based approaches attempt to identify malicious behavior by analyzing the characteristics and behavior of software. Although more flexible, these methods still struggle with high false-positive rates and often cannot detect sophisticated or new attack vectors [2]. Another traditional method is anomaly-based detection, which identifies deviations from established normal behavior profiles. Although this method can potentially detect novel attacks, it is often plagued by high false-positive rates and requires extensive training data to establish accurate behavior profiles [3]. Moreover, these methods are inherently reactive, providing solutions only after an attack has been identified and analyzed. Consequently, zero-day attacks, which exploit unknown vulnerabilities, remain a persistent and formidable threat. The National Institute of Standards and Technology (NIST) reports that zero-day vulnerabilities are particularly dangerous because they exploit security gaps that developers are unaware of, leaving systems unprotected until the vulnerability is identified and patched [4]. Cybersecurity incidents are on the rise, leading to a greater focus on cybersecurity research due to increased awareness. At the same time, cybercriminals are getting better at creating new types of attacks. These attacks often use new methods to hide their activities and target specific weaknesses in software. The software world is changing fast, with new programs and technologies being developed all the time. As a result, new vulnerabilities are constantly appearing, giving attackers opportunities to exploit them [5]. This creates a never-ending game of cat and mouse between defenders and attackers. These newly discovered vulnerabilities are known as zero-day vulnerabilities and can be used to launch new types of attacks called zero-day attacks [6; 7]. Zero-day attacks, though not common, pose a significant and serious threat due to the limited information available at the time they occur. These attacks exploit vulnerabilities that are unknown to the public or software developers when they are first used [8; 9]. The relationship between zero-day attacks and vulnerabilities is direct and reciprocal. The NIST CVE database recorded 28,828 vulnerabilities in 2023 [10], highlighting the extensive nature of potential risks. These zero-day vulnerabilities can have a profound impact on web applications, especially those designed for sharing and disseminating information. Websites that serve as primary hubs for e-commerce, entertainment, and services are particularly vulnerable [11]. Platforms like WordPress simplify website development for novice users by offering pre-built packages that streamline the process. A crucial feature of these platforms is the inclusion of web forms, which allow users to input personal and sensitive information [12]. With WordPress holding a 42.7% market share [13], any zero-day vulnerability in this context can have severe consequences for a large number of users, potentially compromising the security of sensitive information. One significant area of concern is cross-site scripting (XSS) vulnerabilities, which enable the injection and execution of malicious code within web applications. XSS attacks are broadly categorized into three types: persistent, reflective, and DOM-based XSS attacks [14]. Specifically, WordPress plugins that require user input can significantly increase the risk of XSS attacks, affecting both the client side and the admin side.