CVE-2024-2735

Executive Summary

CVE-2024-2735 is a Stored Cross-Site Scripting (XSS) vulnerability in the Bold Page Builder plugin for WordPress, affecting all versions up to and including 4.8.8. The flaw resides in the 'Price List' element, where user-supplied attributes are not properly sanitized or escaped. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts that execute when any user visits the compromised page. This vulnerability is part of the WordPress ecosystem and is not related to the underlying web server (Apache/Nginx). The CVSS score is 6.4 (Medium), and no public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should monitor for updates from the vendor (Bold) and consider removing the plugin if no patch is released. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is elevated due to the low privileges required and the lack of user interaction. An attacker can persistently inject malicious scripts into pages, affecting all visitors.

Deep Dive & Mechanics

The vulnerability exists in the Price List element of the Bold Page Builder plugin. When a user with contributor-level access or higher creates or edits a page using this element, the plugin fails to sanitize and escape user-supplied attributes (e.g., title, description, price). This allows an attacker to inject JavaScript code that is stored in the WordPress database and executed when the page is rendered.

The attack flow:

1. Attacker logs in with contributor-level credentials.
2. Attacker creates or edits a page containing the 'Price List' element.
3. Attacker injects malicious JavaScript into an attribute field (e.g., <script>alert('XSS')</script>).
4. The plugin stores the payload without sanitization.
5. When any user (including administrators) visits the page, the script executes in their browser.

Vulnerable vs. Patched Code

Vulnerable Code (Bold Page Builder <= 4.8.8): The plugin likely uses echo or print to output user-supplied attributes without escaping. For example:

echo '<div class="price-list-item" data-title="' . $attributes['title'] . '">';

Patched Code (Hypothetical): A patch would escape the output using WordPress functions like esc_attr():

echo '<div class="price-list-item" data-title="' . esc_attr($attributes['title']) . '">';

Exploitation & Lab Setup

Red Team

Since no public exploit code is available, a proof-of-concept can be created:

1. Install WordPress with Bold Page Builder 4.8.8.
2. Log in as a contributor.
3. Create a new page and add the 'Price List' element.
4. In the 'Title' field, enter: <script>alert(document.cookie)</script>
5. Save and publish the page.
6. Visit the page as an administrator to trigger the XSS.

Blue Team

To test for the vulnerability:

1. Review pages created by contributors for suspicious JavaScript in 'Price List' elements.
2. Use a web application scanner to detect stored XSS.
3. Monitor WordPress logs for unusual page edits.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/bold-page-builder/ (entire plugin directory)
• Database: Pages/posts containing <script> tags in post_content related to the 'Price List' element.
• Network: Outbound connections to attacker-controlled domains from compromised pages.
• Logs: WordPress audit logs showing page edits by contributor-level users with unusual content.

Detection Engineering

YARA Rule

rule CVE_2024_2735_Bold_Page_Builder_XSS {
    meta:
        description = "Detects stored XSS payloads in Bold Page Builder Price List element"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-2735"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $price_list = /bold-page-builder.*price-list/i
    condition:
        $price_list and $xss_payload
}

Sigma Rule

title: CVE-2024-2735 Stored XSS in Bold Page Builder
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS attempts via Bold Page Builder Price List element
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "/wp-admin/post.php"
        http.body|contains: "bold-page-builder"
        http.body|contains|re: "<script[^>]*>.*<\/script>"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in page content (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-2735 Stored XSS in Bold Page Builder"; flow:to_server,established; content:"/wp-admin/post.php"; http_uri; content:"bold-page-builder"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the Bold Page Builder plugin until a patch is released.
2. Short-term: Restrict contributor-level access to trusted users only.
3. Long-term: Apply input validation and output escaping to all user-supplied attributes in the plugin.
4. Workaround: Use a Web Application Firewall (WAF) to block XSS payloads in page/post content.
5. Monitor: Regularly review WordPress logs for suspicious activity.

Valters IT - DevSecOps & Cyber Threat Intelligence Expert