CVE-2024-1238

Executive Summary

CVE-2024-1238 is a Stored Cross-Site Scripting (XSS) vulnerability in the ElementsKit Elementor addons plugin for WordPress, affecting all versions up to and including 3.0.6. The flaw resides in the button ID parameter, where insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses a compromised page. The vulnerability has a CVSS score of 6.4 (Medium), and no patch has been confirmed at the time of analysis. CVE-2024-32505 is likely a duplicate of this issue.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor the plugin’s update channel and apply any security patches immediately. No third-party package manager (NPM, PyPI, Go, Ruby) is involved.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor)
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The threat level is considered Medium due to the requirement for authenticated access and user interaction, but the potential for widespread exploitation via stored scripts in WordPress pages elevates the risk.

Deep Dive & Mechanics

The vulnerability exists in the button widget of the ElementsKit plugin. The button_id parameter is not properly sanitized before being stored in the database and later rendered in the frontend. An attacker with contributor-level access can craft a malicious payload, such as:

<script>alert('XSS')</script>

When the page is viewed by any user (including administrators), the script executes in the context of the victim’s browser. This can lead to session hijacking, defacement, or redirection to malicious sites.

The root cause is the lack of proper escaping when outputting the button_id value in the widget’s template. The plugin uses echo esc_attr($button_id) but fails to sanitize the input before storage, allowing stored XSS.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.0.6):

// In elementskit/widgets/button/button.php
$button_id = $settings['button_id'];
// No sanitization before storage
update_post_meta($post_id, '_elementor_data', $data);
// Later in template:
echo '<div id="' . esc_attr($button_id) . '">';

Patched Code (Hypothetical):

// Sanitize input before storage
$button_id = sanitize_html_class($settings['button_id']);
// Or use wp_kses_post for broader sanitization
$button_id = wp_kses_post($settings['button_id']);
// Continue with output escaping
echo '<div id="' . esc_attr($button_id) . '">';

The patch should include input sanitization (e.g., sanitize_html_class or wp_kses_post) in addition to output escaping.

Exploitation & Lab Setup

Red Team

1. Prerequisites: WordPress instance with ElementsKit <= 3.0.6, a contributor-level account.
2. Steps:
   • Log in as contributor.
   • Create or edit a page using Elementor.
   • Add the ElementsKit Button widget.
   • In the button ID field, inject: "><script>alert(document.cookie)</script>
   • Save and publish the page.
   • When an admin or visitor views the page, the script executes.

Proof-of-Concept Payload:

"><img src=x onerror=alert('XSS')>

Blue Team

1. Detection: Monitor for unusual button ID values in Elementor data. Look for patterns like <script>, onerror, or javascript:.
2. Prevention: Restrict contributor-level access to trusted users only. Implement a Web Application Firewall (WAF) rule to block XSS payloads in POST parameters.
3. Response: If compromised, remove the malicious page, reset affected user sessions, and audit all pages for injected scripts.

Indicators of Compromise (IOCs)

• File: wp-content/plugins/elementskit/widgets/button/button.php (vulnerable version)
• Database: wp_postmeta entries containing _elementor_data with suspicious button_id values.
• Network: HTTP requests to WordPress pages with button_id parameters containing script tags.
• Logs: WordPress debug logs showing unexpected script execution errors.

Detection Engineering

YARA Rule

rule CVE_2024_1238_ElementsKit_XSS {
    meta:
        description = "Detects stored XSS payloads in ElementsKit button_id parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-1238"
    strings:
        $payload1 = /button_id["']?\s*[:=]\s*["'][^"']*<script/i
        $payload2 = /button_id["']?\s*[:=]\s*["'][^"']*onerror/i
        $payload3 = /button_id["']?\s*[:=]\s*["'][^"']*onload/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-1238 ElementsKit Stored XSS Detection
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects stored XSS attempts via ElementsKit button_id parameter
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'elementor'
        cs-uri-query|contains: 'button_id'
        cs-uri-query|re: 'button_id[^&]*<script'
    condition: selection
falsepositives:
    - Legitimate use of script tags in button IDs (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-1238 ElementsKit Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"elementor"; http_uri; content:"button_id"; http_client_body; pcre:"/button_id[^&]*<script/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the ElementsKit plugin until a patch is available.
2. Short-term: Restrict contributor-level access to only trusted users. Implement a WAF rule to block XSS payloads.
3. Long-term: Apply the official patch once released. Update to the latest version of ElementsKit.
4. Workaround: Manually sanitize the button_id parameter by adding sanitize_html_class() in the plugin code (if you have developer access).

Valters IT
Securing Digital Frontiers