CVE-2024-6884

Executive Summary

CVE-2024-6884 is a Stored Cross-Site Scripting (XSS) vulnerability in the Gutenberg Blocks with AI by Kadence WP WordPress plugin. The plugin fails to properly validate and escape block options before outputting them on a page or post where the block is embedded. This allows authenticated users with at least the Contributor role to inject arbitrary JavaScript into the WordPress database. When an administrator or other user views the compromised page, the injected script executes in their browser, potentially leading to session hijacking, defacement, or privilege escalation.

This vulnerability is specific to the WordPress ecosystem and affects the Kadence Blocks plugin. No public exploit code or proof-of-concept is currently available, but the risk is significant due to the widespread use of this plugin.

Supply Chain & Package Security

This vulnerability is not in an NPM, PyPI, Go, or Ruby package. It is a WordPress plugin vulnerability. The plugin is distributed via the WordPress plugin repository and can be updated through the WordPress admin dashboard.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs Contributor-level access or higher.
• User Interaction (UI): Required (R) – A user with higher privileges must view the compromised page.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure is possible.
• Integrity (I): Low (L) – Limited modification of data is possible.
• Availability (A): None (N) – No impact on availability.

CVSS Score: 5.4 (Medium)

Threat Level: Medium. The vulnerability requires authentication and user interaction, but the potential for privilege escalation and site compromise makes it a serious concern.

Deep Dive & Mechanics

The vulnerability lies in how the Kadence Blocks plugin handles block options (attributes) when rendering Gutenberg blocks. The plugin does not sanitize or escape certain block options before outputting them into the page's HTML. An attacker with Contributor-level access can create or edit a post/page and insert a vulnerable Kadence block. By manipulating the block's options (e.g., a text field or URL parameter), they can inject a malicious JavaScript payload. When the post is saved and later viewed by an administrator, the payload executes in the context of the admin's session.

The root cause is a lack of output escaping on dynamic block attributes. WordPress provides functions like esc_attr() and esc_html() to safely output data, but the plugin fails to use them for specific block options.

Vulnerable vs. Patched Code

Vulnerable Code (before 3.2.39):

// In a block render callback
$output = '<div class="kadence-block" data-option="' . $attributes['some_option'] . '">';
echo $output;

Here, $attributes['some_option'] is directly concatenated into the HTML without escaping.

Patched Code (3.2.39+):

// In a block render callback
$output = '<div class="kadence-block" data-option="' . esc_attr( $attributes['some_option'] ) . '">';
echo $output;

The esc_attr() function ensures that any special characters (like quotes or <script> tags) are safely encoded, preventing XSS.

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Prerequisites: A WordPress site with Kadence Blocks < 3.2.39, and a user account with Contributor role or higher.
2. Steps:
   • Log in as a Contributor.
   • Create a new post or edit an existing one.
   • Add a Kadence block that has a vulnerable option (e.g., a text field for a custom CSS class or a URL).
   • In the block's option field, enter a payload such as: " onmouseover="alert('XSS')".
   • Save the post as a draft or publish it.
   • When an administrator views the post, the payload executes.

Example Payload:

" onfocus="alert(document.cookie)" autofocus=""

Blue Team (Detection & Defense)

• Detection: Monitor for unusual block option values in the database. Look for patterns like on*= or <script> in post meta fields.
• Defense: Ensure the plugin is updated to version 3.2.39 or later. Implement a Web Application Firewall (WAF) rule to block common XSS payloads in post content.
• Hunting: Search the database for posts containing suspicious HTML attributes in block options.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/kadence-blocks/ (version < 3.2.39)
• Database: Posts or pages containing Kadence blocks with unescaped HTML attributes in the post_content field.
• Logs: HTTP requests to /wp-admin/post.php or /wp-admin/admin-ajax.php with suspicious block option values.
• Network: Outbound connections from the WordPress server to attacker-controlled domains (if the payload exfiltrates data).

Detection Engineering

YARA Rule

rule CVE_2024_6884_Kadence_XSS {
    meta:
        description = "Detects vulnerable Kadence Blocks plugin files"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2024-6884"
    strings:
        $vuln_func = /echo\s*\$attributes\[/
        $vuln_pattern = /data-option="\s*\$attributes\[/
    condition:
        $vuln_func or $vuln_pattern
}

Sigma Rule

title: CVE-2024-6884 Kadence Blocks Stored XSS
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects stored XSS attempts via Kadence Blocks plugin
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url: '/wp-admin/post.php*'
        http.body: '*kadence*'
        http.body: '*on*=' 
    condition: selection
falsepositives:
    - Legitimate use of event handlers in block options (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6884 Kadence Blocks Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"kadence"; http_client_body; pcre:"/on\w+=/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Update the Kadence Blocks plugin to version 3.2.39 or later.
2. Short-term: If immediate update is not possible, restrict Contributor and Author roles from using Kadence blocks until the patch is applied.
3. Long-term: Implement a Content Security Policy (CSP) header to mitigate the impact of XSS. Regularly audit plugin code for similar vulnerabilities.
4. Validation: After patching, verify that the plugin version is 3.2.39+ and test that block options are properly escaped.

Valters IT
Securing Digital Frontiers