CVE-2024-7100

Executive Summary

CVE-2024-7100 is a Stored Cross-Site Scripting (XSS) vulnerability in the Bold Page Builder plugin for WordPress, affecting all versions up to and including 5.0.2. The flaw resides in the bt_bb_button shortcode, where user-supplied attributes are insufficiently sanitized and escaped. An authenticated attacker with at least contributor-level access can inject arbitrary web scripts that execute when any user visits the compromised page. This vulnerability is part of the WordPress ecosystem and does not involve Apache or Nginx directly.

WordPress Ecosystem Context

This vulnerability specifically targets the WordPress plugin ecosystem. The Bold Page Builder plugin is a commercial page builder used to create custom layouts. The bt_bb_button shortcode is a core component that renders buttons with user-defined attributes (e.g., url, text, icon). The lack of proper output escaping on these attributes allows stored XSS.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ability for authenticated users to inject persistent scripts that affect all visitors makes this a significant risk for WordPress sites with multiple authors.

Deep Dive & Mechanics

The vulnerability exists in the bt_bb_button shortcode handler. The plugin registers a shortcode that accepts attributes like url, text, icon, color, etc. When rendering the button, the plugin constructs HTML output using these attributes without proper escaping. Specifically, the url attribute is often used in an href attribute, and if not escaped, allows injection of javascript: URIs or event handlers.

Root Cause: The plugin uses esc_attr() inconsistently or not at all for certain attributes. For example, the url attribute might be directly concatenated into an <a> tag without being passed through esc_url(). Similarly, the text attribute might be output without esc_html().

Attack Flow:

1. An attacker with contributor-level access creates or edits a post/page.
2. They insert the [bt_bb_button] shortcode with a malicious payload in the url attribute, e.g., url="javascript:alert('XSS')".
3. The plugin renders the button with the malicious href.
4. When any user (including admins) views the page, the script executes in their browser.

Vulnerable vs. Patched Code

Vulnerable Code (<= 5.0.2):

// In bold-page-builder/shortcodes/bt_bb_button.php
$output = '<a href="' . $url . '" ...>' . $text . '</a>';

Here, $url and $text are taken directly from shortcode attributes without escaping.

Patched Code (Hypothetical):

$output = '<a href="' . esc_url($url) . '" ...>' . esc_html($text) . '</a>';

The patched version would use esc_url() for the URL and esc_html() for the text to prevent XSS.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Bold Page Builder <= 5.0.2
• Contributor-level account or higher

Exploit Steps:

1. Log in as a contributor.
2. Create a new post or edit an existing one.
3. Switch to Text/Code editor and insert:

   [bt_bb_button url="javascript:alert(document.cookie)" text="Click Me"]
   

4. Publish the post.
5. When any user visits the post, the JavaScript executes.

Advanced Payload:

[bt_bb_button url="\" onmouseover=\"alert(1)\"" text="Hover Me"]

This injects an onmouseover event handler.

Blue Team (Detection & Hardening)

Detection:

• Monitor for shortcode usage with suspicious attributes in post content.
• Look for javascript: URIs or event handlers in bt_bb_button shortcodes.

Hardening:

• Restrict contributor-level access to trusted users only.
• Use a Web Application Firewall (WAF) to block XSS payloads.
• Apply input validation on shortcode attributes via custom filters.

Indicators of Compromise (IOCs)

• Post Content: Presence of [bt_bb_button shortcode with url containing javascript: or event handlers.
• HTTP Requests: POST requests to /wp-admin/post.php with post_content containing malicious shortcode.
• Browser Behavior: Unexpected script execution on pages using Bold Page Builder buttons.
• Logs: WordPress audit logs showing shortcode modifications by contributor-level users.

Detection Engineering

YARA Rule

rule CVE_2024_7100_Bold_Page_Builder_XSS {
    meta:
        description = "Detects stored XSS payloads in Bold Page Builder bt_bb_button shortcode"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-7100"
    strings:
        $shortcode = /\[bt_bb_button[^\]]*?url\s*=\s*["']javascript:/i
        $event_handler = /\[bt_bb_button[^\]]*?on\w+\s*=\s*["']/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-7100 - Bold Page Builder Stored XSS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS via bt_bb_button shortcode in WordPress
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: '/wp-admin/post.php'
        http.body|contains: '[bt_bb_button'
        http.body|re: 'url\s*=\s*["\']javascript:'
    condition: selection
falsepositives:
    - Legitimate use of javascript: URIs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-7100 - Bold Page Builder Stored XSS"; flow:to_server,established; content:"/wp-admin/post.php"; http_uri; content:"[bt_bb_button"; http_client_body; pcre:"/url\s*=\s*[\x22\x27]javascript:/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if no patch is available.
2. Restrict contributor-level access to only trusted users.
3. Audit existing posts for malicious shortcode usage.

Long-term Fix:

• Apply the vendor patch when released (currently UNKNOWN).
• Implement a custom filter to sanitize shortcode attributes:

  add_filter('shortcode_atts_bt_bb_button', function($out, $pairs, $atts) {
      $out['url'] = esc_url($out['url']);
      $out['text'] = esc_html($out['text']);
      return $out;
  }, 10, 3);
  

Workaround:

• Use a security plugin like Wordfence to block XSS payloads.
• Implement Content Security Policy (CSP) headers to mitigate script execution.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert