CVE-2024-5289

Executive Summary

CVE-2024-5289 is a Stored Cross-Site Scripting (XSS) vulnerability in the Kadence WP – Gutenberg Blocks with AI plugin for WordPress, affecting all versions up to and including 3.2.42. The flaw resides in the Google Maps widget parameters, where insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses a page containing the malicious payload, leading to potential session hijacking, data theft, or defacement.

This vulnerability is specific to the WordPress ecosystem and does not involve Apache or Nginx directly. The plugin is widely used for building page layouts with Gutenberg blocks, making this a high-impact issue for sites with multiple authors.

Supply Chain & Package Security

This is a WordPress plugin vulnerability, not an NPM, PyPI, Go, or Ruby package. However, the plugin may be distributed via the WordPress plugin repository or bundled with themes. Users should verify the integrity of plugin files and monitor for updates from the vendor.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is elevated due to the low privileges required and the potential for widespread exploitation in multi-author WordPress environments.

Deep Dive & Mechanics

The vulnerability exists in the Google Maps block provided by the Kadence Blocks plugin. When a user with Contributor-level access or higher inserts a Google Maps block, the plugin fails to properly sanitize user-supplied parameters such as map center coordinates, zoom level, or marker data. This allows an attacker to inject JavaScript code into the block's output.

The injected script is stored in the WordPress database and executed in the browser of any visitor viewing the affected page. Since the plugin does not escape the output on the frontend, the malicious payload is rendered as HTML/JavaScript.

Root Cause: The plugin uses echo or similar functions without applying esc_attr() or esc_html() to user input in the Google Maps widget parameters.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 3.2.42):

// In a function rendering the Google Maps block
$map_center = get_post_meta( $post_id, 'kadence_blocks_map_center', true );
echo '<div class="kb-google-maps" data-center="' . $map_center . '"></div>';

Here, $map_center is directly echoed without escaping, allowing XSS.

Patched Code (hypothetical fix):

$map_center = get_post_meta( $post_id, 'kadence_blocks_map_center', true );
echo '<div class="kb-google-maps" data-center="' . esc_attr( $map_center ) . '"></div>';

The fix applies esc_attr() to escape the attribute value, preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Kadence Blocks plugin <= 3.2.42
• Authenticated user with Contributor role or higher
• Access to the Gutenberg editor

Steps:

1. Log in as a Contributor.
2. Create a new post or page.
3. Add a Kadence Google Maps block.
4. In the map center field, inject a payload such as:

   " onload="alert('XSS')" x="
   

5. Save and publish the post.
6. When any user visits the post, the script executes.

Example Payload:

" onfocus="alert(document.cookie)" autofocus="

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual JavaScript execution in the context of Kadence Blocks.
• Review database entries for suspicious HTML in post meta fields related to kadence_blocks_map_center.

Prevention:

• Update the plugin to a patched version (once available).
• Restrict Contributor-level access to trusted users only.
• Use a Web Application Firewall (WAF) to block XSS payloads.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/kadence-blocks/ (check version in readme.txt)
• Database: Post meta with key kadence_blocks_map_center containing HTML/JavaScript
• Network: Outbound requests to attacker-controlled domains from compromised pages
• Logs: WordPress debug logs showing unexpected script execution

Detection Engineering

YARA Rule

rule CVE_2024_5289_Kadence_XSS {
    meta:
        description = "Detects malicious payloads in Kadence Blocks Google Maps meta"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-5289"
    strings:
        $payload1 = /<script[^>]*>.*<\/script>/i
        $payload2 = /on\w+\s*=\s*['\"][^'\"]*['\"]/i
        $meta_key = "kadence_blocks_map_center"
    condition:
        $meta_key and ($payload1 or $payload2)
}

Sigma Rule

title: CVE-2024-5289 Kadence Blocks XSS Detection
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b1d3f4a5c6e
status: experimental
description: Detects stored XSS in Kadence Blocks Google Maps widget
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "/wp-admin/post.php"
        http.body|contains: "kadence_blocks_map_center"
        http.body|contains|re: "(<script|onload|onerror|onfocus)"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in map parameters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-5289 Kadence Blocks XSS Attempt"; flow:to_server,established; content:"kadence_blocks_map_center"; http_client_body; pcre:"/(<script|on\w+\s*=)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin to the latest version once a patch is released by Kadence WP.
2. Disable the Google Maps block temporarily via a custom plugin or filter:

   add_filter( 'kadence_blocks_register_blocks', function( $blocks ) {
       unset( $blocks['google-maps'] );
       return $blocks;
   } );
   

3. Review and sanitize existing post meta for any injected scripts.

Long-term Mitigation:

• Implement Content Security Policy (CSP) headers to restrict script execution.
• Use a WordPress security plugin to monitor file changes and detect XSS.
• Educate users with Contributor roles about safe content creation practices.

Valters IT
Securing Digital Frontiers