CVE-2024-0845

Executive Summary

CVE-2024-0845 is a Stored Cross-Site Scripting (XSS) vulnerability in the PDF Viewer for Elementor plugin for WordPress, affecting all versions up to and including 2.9.3. The flaw resides in the plugin’s render function, which fails to properly sanitize user input and escape output. This allows authenticated attackers with at least Contributor-level access to inject arbitrary web scripts. When a victim (including site administrators or visitors) accesses a page containing the malicious payload, the script executes in their browser context, potentially leading to session hijacking, data theft, or further compromise.

Given the widespread use of Elementor as a page builder, this vulnerability poses a significant risk to WordPress sites using the plugin. The EPSS score is 0.0%, indicating low exploitation activity at the time of analysis, but the lack of a patch increases the urgency for mitigation.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory. Users should verify they are not using a compromised or outdated version. No NPM, PyPI, Go, or Ruby packages are involved.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): Low – Attacker needs Contributor-level access.
• User Interaction (UI): Required – Victim must visit the injected page.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): None – No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the potential for stored XSS in a widely-used plugin, combined with the lack of a patch, elevates the risk for targeted attacks.

Deep Dive & Mechanics

The vulnerability exists in the render function of the PDF Viewer for Elementor plugin. This function is responsible for generating the HTML output for the PDF viewer widget. The plugin fails to properly sanitize user-supplied input (e.g., the PDF URL or other parameters) before embedding it into the page’s HTML. Additionally, it does not escape the output when rendering the widget.

An attacker with Contributor-level access (or higher) can create or edit a page using Elementor and insert the PDF Viewer widget. By crafting a malicious PDF URL or other input field, they can inject JavaScript code. For example, a payload like javascript:alert(document.cookie) or an event handler like onload=alert(1) could be embedded. When the page is rendered, the injected script executes in the context of the victim’s browser.

The attack flow:

1. Attacker logs in with Contributor-level credentials.
2. Attacker creates a new page or edits an existing one using Elementor.
3. Attacker adds the PDF Viewer widget and sets a malicious parameter (e.g., PDF URL containing XSS payload).
4. The plugin stores the malicious input without proper sanitization.
5. When an administrator or visitor accesses the page, the script executes.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 2.9.3): The render function directly outputs user-supplied data without escaping. Example (simplified):

public function render() {
    $pdf_url = $this->get_settings('pdf_url');
    echo '<iframe src="' . $pdf_url . '"></iframe>';
}

Patched Code (hypothetical): A proper fix would use WordPress’s esc_url() and wp_kses_post() functions to sanitize and escape output:

public function render() {
    $pdf_url = esc_url($this->get_settings('pdf_url'));
    echo '<iframe src="' . $pdf_url . '"></iframe>';
}

Additionally, input validation should be performed to ensure the URL is a valid PDF link.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• WordPress site with Elementor and PDF Viewer for Elementor plugin (<=2.9.3).
• Contributor-level account.

Steps:

1. Log in to WordPress as a Contributor.
2. Navigate to Pages > Add New.
3. Edit with Elementor.
4. Add the PDF Viewer widget.
5. In the widget settings, set the PDF URL to a malicious payload, e.g.:

   javascript:alert('XSS')
   

   Or use an event handler:

   " onload="alert(1)
   

6. Publish the page.
7. When an administrator or visitor accesses the page, the script executes.

Proof of Concept (PoC):

<!-- Malicious PDF URL parameter -->
<input type="text" value="javascript:alert(document.cookie)">

Blue Team (Defensive)

Detection:

• Monitor for unusual PDF URL parameters in Elementor widget settings.
• Look for Contributor-level accounts creating pages with suspicious content.
• Use Web Application Firewall (WAF) rules to block common XSS payloads.

Hunting:

• Search for pages containing javascript: or onload= in the _elementor_data post meta.
• Query the database:

  SELECT * FROM wp_postmeta WHERE meta_key = '_elementor_data' AND meta_value LIKE '%javascript:%';
  

Mitigation:

• Disable the PDF Viewer for Elementor plugin until a patch is available.
• Restrict Contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/pdf-viewer-for-elementor/ (entire plugin directory)
• Database: wp_postmeta entries with meta_key = '_elementor_data' containing XSS payloads.
• Network: HTTP requests to pages containing the malicious widget.
• Logs: WordPress debug logs showing unexpected script execution.

Detection Engineering

YARA Rule

rule CVE_2024_0845_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in PDF Viewer for Elementor plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-0845"
    strings:
        $payload1 = "javascript:" ascii wide nocase
        $payload2 = "onload=" ascii wide nocase
        $payload3 = "onerror=" ascii wide nocase
        $payload4 = "<script" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-0845 Stored XSS in PDF Viewer for Elementor
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects stored XSS payloads in Elementor widget data
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        meta_key: '_elementor_data'
        meta_value|contains:
            - 'javascript:'
            - 'onload='
            - 'onerror='
            - '<script'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in PDF URLs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-0845 Stored XSS in PDF Viewer for Elementor"; flow:to_server,established; content:"_elementor_data"; http_client_body; content:"javascript:"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patched version is released.
2. Review and remove any suspicious pages created by Contributor-level users.
3. Change all passwords for Contributor-level accounts if compromise is suspected.

Long-term Fix:

• Apply the official patch once available (check plugin repository).
• Implement input validation and output escaping in custom code.
• Use a Web Application Firewall (WAF) with XSS protection rules.

Workaround:

• Restrict Contributor-level access to only trusted users.
• Use a security plugin (e.g., Wordfence) to block XSS attempts.

Valters IT
Securing Digital Frontiers