CVE-2024-12304

Executive Summary

CVE-2024-12304 is a Stored Cross-Site Scripting (XSS) vulnerability in the Kadence Blocks – Gutenberg Blocks for WordPress plugin (versions up to and including 3.4.2). The flaw resides in the button block link attribute, where insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts. When a user visits a page containing the malicious block, the script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability is specific to the WordPress ecosystem and does not affect the underlying web server (Apache/Nginx). The CVSS score of 6.4 (Medium) reflects the need for authenticated access but the potential for widespread impact due to the stored nature of the payload.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The plugin is a Gutenberg block library, and the risk is limited to WordPress sites using the vulnerable version.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the stored XSS can affect all site visitors, including administrators.

Deep Dive & Mechanics

The vulnerability exists in the button block of the Kadence Blocks plugin. When a user with Contributor-level access or higher creates or edits a page using the Gutenberg editor, they can insert a button block. The plugin fails to properly sanitize the link attribute of the button block before storing it in the database. Additionally, when the page is rendered, the link value is not escaped, allowing arbitrary HTML/JavaScript to be injected.

Attack Flow:

1. An authenticated attacker (Contributor or higher) creates a new page or post.
2. The attacker adds a Kadence Button block and sets the link attribute to a malicious payload, e.g., javascript:alert('XSS') or an event handler like " onmouseover="alert(1).
3. The plugin stores the unsanitized payload in the WordPress database.
4. When any user (including administrators) visits the page, the payload executes in their browser.

Root Cause: The plugin uses esc_url() or similar functions inconsistently, or the button block’s link attribute is not properly escaped during output. The vulnerability is in the render_block function of the plugin.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

// In Kadence Blocks plugin, version <= 3.4.2
function render_button_block($attributes) {
    $link = $attributes['link']; // No sanitization
    $output = '<a href="' . $link . '">Button</a>'; // No escaping
    return $output;
}

Patched Code (expected):

// In a patched version
function render_button_block($attributes) {
    $link = esc_url($attributes['link']); // Sanitize URL
    $output = '<a href="' . esc_attr($link) . '">Button</a>'; // Escape output
    return $output;
}

Note: Since no official patch is available, the above is a recommended fix. The plugin should also validate that the link is a safe protocol (e.g., http, https, mailto).

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Kadence Blocks plugin <= 3.4.2
• Authenticated user with Contributor role or higher

Exploitation Steps:

1. Log in as a Contributor.
2. Create a new page and add a Kadence Button block.
3. In the block settings, set the link to: javascript:alert(document.cookie)
4. Publish the page.
5. When an administrator or visitor views the page, the JavaScript executes.

Alternative Payloads:

• " onfocus="alert(1)" autofocus="
• " onmouseover="alert(1)"

Note: No public exploit code is available, but the vulnerability is straightforward to exploit manually.

Blue Team (Detection & Hardening)

Detection:

• Monitor for pages/posts created by Contributor-level users containing suspicious link attributes.
• Use WAF rules to block javascript: URIs in post content.
• Review WordPress database for stored XSS payloads in wp_posts.post_content.

Hardening:

• Restrict Contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Use a WordPress security plugin that scans for malicious content.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/kadence-blocks/dist/blocks/button.js (or similar) – check for version 3.4.2 or earlier.
• Database: Rows in wp_posts where post_content contains javascript: or event handlers like onmouseover.
• Network: Outbound requests to attacker-controlled domains from the WordPress admin panel.
• Logs: WordPress audit logs showing creation of pages by Contributor users with unusual link attributes.

Detection Engineering

YARA Rule

rule Detect_Kadence_Blocks_XSS {
    meta:
        description = "Detects stored XSS payloads in Kadence Blocks button link"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12304"
    strings:
        $xss1 = /<a\s+href\s*=\s*["']javascript:/i
        $xss2 = /<a\s+href\s*=\s*["'][^"']*on\w+=/i
        $plugin = /kadence-blocks/i
    condition:
        any of ($xss*) and $plugin
}

Sigma Rule

title: Kadence Blocks Stored XSS Detection
id: 8f4b3c2a-1d5e-4f7a-9b0c-3e2d1a4f5b6c
status: experimental
description: Detects stored XSS payloads in WordPress posts created by Kadence Blocks
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        post_content|contains:
            - 'javascript:'
            - 'onmouseover'
            - 'onfocus'
            - 'onclick'
    condition: selection
falsepositives:
    - Legitimate use of javascript: in links (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12304 Kadence Blocks Stored XSS"; flow:to_server,established; content:"POST"; http_method; content:"/wp-json/wp/v2/posts"; http_uri; content:"javascript:"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Restrict Contributor-level access to only trusted users.
3. Review and clean any existing pages/posts created by Contributors for malicious content.

Long-term Fix:

• Apply the vendor patch when available (currently UNKNOWN).
• Implement input validation and output escaping in custom code.
• Use a Web Application Firewall (WAF) to block XSS attempts.

Workaround:

• Add a custom filter to sanitize the button block link:

add_filter('render_block', function($block_content, $block) {
    if ($block['blockName'] === 'kadence/button') {
        $block_content = preg_replace('/<a\s+href\s*=\s*["\']javascript:/i', '<a href="#', $block_content);
    }
    return $block_content;
}, 10, 2);

Valters IT
Securing Digital Frontiers