CVE-2024-1458

Executive Summary

CVE-2024-1458 is a Stored Cross-Site Scripting (XSS) vulnerability in the Elementor Addons by Livemesh WordPress plugin, affecting all versions up to and including 8.3.4. The flaw resides in the text_alignment attribute of the Animated Text widget. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. When a user accesses a page containing the malicious widget, the injected script executes in the context of the victim’s browser. This can lead to session hijacking, credential theft, or defacement. The vulnerability is part of the WordPress ecosystem and does not affect Apache or Nginx directly.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who install the plugin from the repository or via automatic updates are at risk. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is a PHP-based WordPress plugin. Supply chain risk is moderate due to the plugin’s popularity and the lack of a confirmed patch.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires authentication but is easy to exploit once access is obtained. The impact is limited to low confidentiality and integrity loss, but the stored XSS can be used to pivot to higher-privilege accounts.

Deep Dive & Mechanics

The vulnerability exists in the Animated Text widget of the Elementor Addons by Livemesh plugin. The widget allows users to set a text_alignment attribute, which is used to control the alignment of animated text. The plugin fails to properly sanitize user input and escape output when rendering this attribute. An attacker with contributor-level access can create or edit a page using the Animated Text widget and inject malicious JavaScript into the text_alignment field. When the page is rendered, the injected script is executed in the browser of any user who views the page.

The root cause is insufficient input validation and output escaping in the widget’s rendering logic. The plugin likely uses echo or print without applying WordPress’s esc_attr() or esc_html() functions, or it fails to sanitize the attribute value before storing it in the database.

Vulnerable vs. Patched Code

Vulnerable Code (example from version 8.3.4):

// In the widget render method
$text_alignment = $settings['text_alignment'];
echo '<div class="animated-text" data-alignment="' . $text_alignment . '">';

Patched Code (hypothetical fix):

$text_alignment = sanitize_html_class( $settings['text_alignment'] );
echo '<div class="animated-text" data-alignment="' . esc_attr( $text_alignment ) . '">';

The patched version uses sanitize_html_class() to strip dangerous characters and esc_attr() to escape output, preventing XSS.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with Elementor Addons by Livemesh <= 8.3.4
• Contributor-level account or higher

Exploitation Steps:

1. Log in as a contributor.
2. Create a new page or edit an existing one using Elementor.
3. Add the Animated Text widget.
4. In the widget settings, set the text_alignment attribute to the following payload:

   " onmouseover="alert('XSS')"
   

5. Save and publish the page.
6. When any user visits the page and hovers over the animated text, the JavaScript executes.

Alternative Payload (auto-execute):

" autofocus onfocus="alert(document.cookie)"

Blue Team

Detection:

• Monitor for unusual text_alignment values in page/post meta.
• Look for pages containing <div class="animated-text" data-alignment=" followed by suspicious characters.
• Use WAF rules to block common XSS patterns in POST requests to /wp-admin/admin-ajax.php or Elementor endpoints.

Mitigation:

• Disable the Animated Text widget until a patch is applied.
• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/livemesh-elementor-addons/widgets/animated-text.php (or similar path)
• Database: wp_postmeta entries with meta_key containing _elementor_data and meta_value containing text_alignment with suspicious HTML/JavaScript.
• Network: HTTP requests to /wp-admin/admin-ajax.php with action=elementor_ajax and payloads in data parameter.
• Logs: WordPress debug log entries showing esc_attr or sanitize failures.

Detection Engineering

YARA Rule

rule CVE_2024_1458_Stored_XSS {
    meta:
        description = "Detects malicious text_alignment attribute in Elementor Addons by Livemesh"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-1458"
    strings:
        $xss_payload = /data-alignment="[^"]*["\x27]/
        $widget_marker = "livemesh-elementor-addons"
    condition:
        $widget_marker and $xss_payload
}

Sigma Rule

title: CVE-2024-1458 Stored XSS in Elementor Addons by Livemesh
id: 8a3b2c1d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS via text_alignment attribute in Animated Text widget
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: 'POST'
        http.url: '/wp-admin/admin-ajax.php'
        http.body|contains: 'text_alignment'
        http.body|re: '["\x27].*on\w+='
    condition: selection
falsepositives:
    - Legitimate use of alignment values with quotes (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-1458 Stored XSS in Elementor Addons by Livemesh"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"text_alignment"; http_client_body; pcre:"/["\x27].*on\w+=/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin to the latest version if a patch is released. Check the WordPress plugin repository for updates.
2. Disable the Animated Text widget by removing or renaming the widget file in /wp-content/plugins/livemesh-elementor-addons/widgets/.
3. Restrict contributor-level access to only trusted users. Consider using a role editor plugin to limit capabilities.

Long-term Measures:

• Implement a Web Application Firewall (WAF) with rules to block XSS payloads.
• Enforce Content Security Policy (CSP) headers to prevent inline script execution.
• Regularly audit WordPress plugins for vulnerabilities using tools like WPScan.
• Educate content creators about the risks of XSS and safe input practices.

Patch Status: UNKNOWN. Monitor the plugin’s changelog and the WordPress plugin repository for updates.

Valters IT