CVE-2024-10637

Executive Summary

CVE-2024-10637 is a Stored Cross-Site Scripting (XSS) vulnerability in the Gutenberg Blocks with AI by Kadence WP WordPress plugin (versions before 3.2.54). The flaw arises from insufficient validation and escaping of block options before they are output in a page or post where the block is embedded. This allows authenticated users with at least the Contributor role to inject arbitrary web scripts or HTML. When the malicious block is rendered, the injected payload executes in the context of any visitor’s browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability is specific to the WordPress ecosystem and does not affect the underlying web server software.

Supply Chain & Package Security

This vulnerability is in a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin from the repository are affected if they are running a version prior to 3.2.54. No supply chain compromise of the plugin’s source code has been reported; the issue is a code-level oversight in input sanitization.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability is exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – An attacker needs a Contributor-level account or higher.
• User Interaction: None (UI:N) – The victim does not need to perform any action beyond viewing the page.
• Scope: Changed (S:C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure possible.
• Integrity Impact: Low (I:L) – Limited modification of content possible.
• Availability Impact: None (A:N) – No direct denial of service.

Threat Level: Medium. While the CVSS score is moderate, the prevalence of WordPress sites and the low privilege requirement make this a practical attack vector for content injection and phishing.

Deep Dive & Mechanics

The vulnerability resides in the block rendering logic of the Kadence Blocks plugin. When a user inserts a block (e.g., a custom HTML block, accordion, or advanced heading) and provides options such as custom CSS classes, anchor IDs, or inline styles, the plugin fails to properly sanitize and escape these values before outputting them in the page’s HTML.

Specifically, the plugin uses functions like echo $block_options['customClass'] without applying esc_attr() or wp_kses_post(). An attacker with Contributor-level access can craft a block with a payload in a block option field, such as:

" onmouseover="alert('XSS')"

When the block is rendered, the unescaped value is inserted directly into the HTML attribute, breaking out of the attribute context and executing the JavaScript.

The attack flow:

1. Attacker logs in as a Contributor or higher.
2. Creates a new post or page and inserts a vulnerable Kadence block.
3. Injects a malicious payload into a block option (e.g., custom CSS class, anchor, or inline style).
4. Publishes or saves the post as a draft (if the site allows draft viewing).
5. Any user visiting the page triggers the XSS payload.

Vulnerable vs. Patched Code

Vulnerable Code (before 3.2.54):

// In block render callback (simplified)
$custom_class = $block['attrs']['customClass'] ?? '';
echo '<div class="' . $custom_class . '">';

Patched Code (3.2.54+):

// In block render callback (simplified)
$custom_class = $block['attrs']['customClass'] ?? '';
echo '<div class="' . esc_attr($custom_class) . '">';

The patch adds esc_attr() to escape the output, preventing attribute injection. Similar fixes were applied to all block options that were previously unescaped.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Kadence Blocks plugin version < 3.2.54.
• A user account with Contributor role or higher.

Steps:

1. Log in to WordPress as a Contributor.
2. Create a new post.
3. Add a Kadence Blocks “Advanced Heading” block.
4. In the block settings, find the “CSS Class” field and enter:

   " onmouseover="alert(document.cookie)
   

5. Publish the post.
6. When any user visits the post, the XSS triggers on mouseover.

Alternative Payload (auto-execute):

" autofocus onfocus="alert(1)

Blue Team (Detection & Prevention)

Detection:

• Monitor for posts/pages containing suspicious HTML attributes in block content.
• Look for unusual block option values in the wp_posts table (post_content column).
• Use WAF rules to block common XSS patterns in POST requests to wp-admin/post.php.

Prevention:

• Immediately upgrade to Kadence Blocks 3.2.54 or later.
• Restrict Contributor role capabilities if not needed.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• Post Content Pattern: Look for onmouseover, onfocus, onerror, or javascript: in the post_content field of the wp_posts table.
• Block Option Injection: Unescaped double quotes (") followed by event handlers in block attributes.
• HTTP Request: POST to /wp-admin/post.php with post_content containing malicious HTML attributes.
• Log Entries: Suspicious user activity from Contributor accounts creating posts with unusual block configurations.

Detection Engineering

YARA Rule

rule Kadence_Blocks_XSS_CVE_2024_10637 {
    meta:
        description = "Detects stored XSS payloads in Kadence Blocks post content"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-10637"
    strings:
        $xss1 = /on\w+\s*=\s*["']?[^"']*["']?/ nocase
        $xss2 = /javascript\s*:/ nocase
        $block_marker = "wp:kadence/"
    condition:
        $block_marker and ($xss1 or $xss2)
}

Sigma Rule

title: Stored XSS via Kadence Blocks Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts in WordPress posts using Kadence Blocks
author: Valters IT
logsource:
    category: application
    product: wordpress
detection:
    selection:
        post_content|contains:
            - 'onmouseover='
            - 'onfocus='
            - 'onerror='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of event handlers in custom HTML blocks (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-10637 Kadence Blocks Stored XSS Payload";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/post.php"; http_uri;
    content:"post_content"; http_client_body;
    pcre:"/(on\w+\s*=\s*[\x22\x27]|javascript\s*:)/i";
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade the Kadence Blocks plugin to version 3.2.54 or higher.
2. Audit existing posts for injected payloads using the YARA or Sigma rules above.
3. Remove any malicious content found in posts or pages.

Long-Term Mitigations:

• Implement a Web Application Firewall (WAF) with rules to block XSS patterns.
• Enforce Content Security Policy (CSP) headers to restrict script execution.
• Regularly update all WordPress plugins and themes.
• Limit user roles: only grant Contributor access when absolutely necessary.

Verification:

• After patching, test by attempting to inject XSS in a staging environment.
• Monitor logs for any recurrence of the attack pattern.

Report generated by Valters IT DevSecOps & CTI Division