CVE-2024-9655

Executive Summary

CVE-2024-9655 is a Stored Cross-Site Scripting (XSS) vulnerability in the Kadence Blocks – Gutenberg Blocks for Page Builder Features plugin for WordPress, affecting all versions up to and including 6.6.2. The flaw resides in the plugin's Icon widget, where insufficient input sanitization and output escaping on user-supplied attributes allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a victim user accesses a page containing the malicious payload. Given the widespread use of Kadence Blocks in WordPress sites, this vulnerability poses a significant risk for site defacement, data theft, and further compromise.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who install the plugin directly from the WordPress dashboard or via automated deployment tools are at risk. The plugin is not distributed via NPM, PyPI, Go, or Ruby ecosystems.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires authentication but is easily exploitable by low-privileged users. The stored XSS can affect all site visitors, including administrators, potentially leading to privilege escalation or data exfiltration.

Deep Dive & Mechanics

The vulnerability exists in the kadence-blocks plugin's Icon widget. When rendering the Icon block, the plugin processes user-supplied attributes (such as icon, link, style, etc.) without proper sanitization or output escaping. An attacker with contributor-level access can craft a malicious Icon block containing JavaScript payloads within these attributes. When the block is saved and rendered on a page, the payload is executed in the context of the victim's browser.

The root cause is the lack of esc_attr() or wp_kses() filtering on attributes that are directly output into HTML attributes or inline event handlers. For example, the link attribute might be used in an <a> tag's href without proper validation, allowing javascript: URIs or event handlers like onmouseover.

Vulnerable vs. Patched Code

Vulnerable Code (<= 6.6.2): In the Icon block render function, attributes are output directly without escaping:

$icon_html = sprintf(
    '<span class="kt-svg-icon" style="display:inline-flex; justify-content:center; align-items:center;">
        <a href="%s" style="...">
            <svg ...>...</svg>
        </a>
    </span>',
    $attributes['link'] // No escaping
);

Patched Code (Hypothetical): The patched version would use esc_url() for URLs and esc_attr() for other attributes:

$icon_html = sprintf(
    '<span class="kt-svg-icon" style="display:inline-flex; justify-content:center; align-items:center;">
        <a href="%s" style="...">
            <svg ...>...</svg>
        </a>
    </span>',
    esc_url( $attributes['link'] ) // Proper escaping
);

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with Kadence Blocks plugin <= 6.6.2
• Contributor-level account or higher

Exploitation Steps:

1. Log in as a contributor.
2. Create a new post or page.
3. Add a Kadence Icon block.
4. In the block settings, set the link attribute to a malicious payload:

   javascript:alert(document.cookie)
   

   Or use an event handler:

   " onmouseover="alert(1)
   

5. Publish the page.
6. When any user (including admin) visits the page, the XSS triggers.

Proof-of-Concept Payload:

<a href="javascript:alert('XSS')">Click me</a>

Blue Team

Detection:

• Monitor for posts/pages created by low-privileged users containing suspicious HTML attributes.
• Look for javascript: URIs or event handlers in post content.
• Use WAF rules to block common XSS patterns in POST requests.

Hunting Query (SQL):

SELECT ID, post_title, post_content
FROM wp_posts
WHERE post_content LIKE '%javascript:%'
   OR post_content LIKE '%onmouseover%'
   OR post_content LIKE '%onload%';

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/kadence-blocks/includes/blocks/class-kadence-blocks-icon-block.php (vulnerable file)
• Pattern in Database: Post content containing javascript: URIs or inline event handlers within Kadence Icon block markup.
• Network: Outbound connections to attacker-controlled domains from compromised admin sessions.
• Logs: Unusual post creation by contributor-level users with suspicious block attributes.

Detection Engineering

YARA Rule

rule CVE_2024_9655_Kadence_Icon_XSS {
    meta:
        description = "Detects malicious Kadence Icon block payloads"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-9655"
    strings:
        $xss1 = /<a[^>]*href\s*=\s*["']\s*javascript:/i
        $xss2 = /<a[^>]*on\w+\s*=\s*["']/i
        $kadence_icon = /kt-svg-icon/
    condition:
        $kadence_icon and ($xss1 or $xss2)
}

Sigma Rule

title: CVE-2024-9655 Kadence Icon XSS Detection
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects stored XSS attempts via Kadence Icon block
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url: '/wp-admin/post.php'
        http.body|contains: 'kadence/icon'
        http.body|contains|any:
            - 'javascript:'
            - 'onmouseover'
            - 'onload'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in links (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-9655 Kadence Icon XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"kadence/icon"; http_client_body; pcre:"/(javascript:|on\w+=)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Plugin: Upgrade Kadence Blocks to version 6.6.3 or later as soon as a patch is released.
2. Disable Plugin: If no patch is available, temporarily deactivate the plugin.
3. Restrict User Roles: Limit contributor-level access to trusted users only.
4. Web Application Firewall (WAF): Deploy WAF rules to block XSS payloads in post content.

Long-term Measures:

• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Regularly audit user permissions and remove unnecessary accounts.
• Enable automatic plugin updates for WordPress.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.