CVE-2024-2784

Executive Summary

CVE-2024-2784 is a Stored Cross-Site Scripting (XSS) vulnerability in the The Plus Addons for Elementor WordPress plugin, affecting all versions up to and including 5.5.4. The flaw resides in the Hover Card widget, where user-supplied attributes are not properly sanitized or escaped. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts that execute when any user visits the compromised page. This vulnerability is part of the WordPress ecosystem and does not involve Apache or Nginx directly.

CVSS Score: 6.4 (Medium)
EPSS Score: 0.0% (low exploitation probability)
Patch Status: Unpatched (no official fix available)

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should monitor the plugin’s update channel and consider removing or disabling the Hover Card widget until a patch is released. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs contributor-level access.
• User Interaction (UI): None (N) – No user action needed for execution.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the ability to inject persistent scripts in a WordPress environment can lead to session hijacking, defacement, or phishing attacks.

Deep Dive & Mechanics

The vulnerability exists in the Hover Card widget of The Plus Addons for Elementor. The widget accepts user-controlled attributes (e.g., data-* attributes or custom CSS classes) that are rendered directly into the HTML without proper sanitization or output escaping. When an attacker with contributor-level access creates or edits a page using this widget, they can inject malicious JavaScript payloads into these attributes. The payload is stored in the WordPress database and executed in the browser of any user viewing the page.

Root Cause: Insufficient input sanitization and output escaping on user-supplied attributes in the Hover Card widget’s rendering logic.

Attack Vector:

1. Attacker logs in with contributor-level privileges.
2. Creates a new page or edits an existing one using the Hover Card widget.
3. Injects a malicious script (e.g., <script>alert('XSS')</script>) into a widget attribute.
4. The script is stored and executed when any user visits the page.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 5.5.4):
The widget likely uses echo or print to output user-supplied attributes without escaping. Example (pseudo-code):

echo '<div class="hover-card" data-custom="' . $attributes['custom_data'] . '">';

Patched Code (hypothetical):
Proper escaping using esc_attr() or wp_kses():

echo '<div class="hover-card" data-custom="' . esc_attr($attributes['custom_data']) . '">';

Since no official patch exists, users must manually apply input validation and output escaping.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with The Plus Addons for Elementor <= 5.5.4.
• Contributor-level account.

Exploit Steps:

1. Log in as a contributor.
2. Navigate to Pages > Add New.
3. Add the Hover Card widget to the page.
4. In the widget settings, locate an attribute field (e.g., "Custom CSS Class" or "Data Attribute").
5. Inject payload: "><script>alert(document.cookie)</script>
6. Publish the page.
7. When any user visits the page, the script executes.

Proof-of-Concept (PoC) Payload:

"><img src=x onerror=alert('XSS')>

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual widget attribute values in page/post content.
• Look for patterns like onerror, onload, <script> in custom fields.
• Use Web Application Firewall (WAF) rules to block common XSS patterns.

Prevention:

• Disable the Hover Card widget until a patch is available.
• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate script execution.

Indicators of Compromise (IOCs)

• File Indicators:

  • Modified page/post content containing <script> tags or event handlers in widget attributes.
  • Presence of malicious payloads in wp_postmeta table for _elementor_data meta key.

• Network Indicators:

  • Outbound requests to attacker-controlled domains from compromised pages.
  • Unusual JavaScript files loaded from external sources.

• Log Indicators:

  • WordPress audit logs showing creation/editing of pages by contributors with suspicious attribute values.
  • WAF logs blocking XSS attempts on Hover Card widget endpoints.

Detection Engineering

YARA Rule

rule CVE_2024_2784_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in The Plus Addons for Elementor Hover Card widget"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-2784"
    strings:
        $payload1 = /<script[^>]*>.*?<\/script>/is
        $payload2 = /onerror\s*=\s*["']?[^"'\s>]+["']?/is
        $payload3 = /onload\s*=\s*["']?[^"'\s>]+["']?/is
        $widget = /theplus_hover_card/i
    condition:
        any of ($payload*) and $widget
}

Sigma Rule

title: Stored XSS via The Plus Addons for Elementor Hover Card
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts in WordPress pages using the Hover Card widget
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        event: wp_insert_post
        post_content|contains:
            - 'theplus_hover_card'
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in widget attributes (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-2784 Stored XSS in The Plus Addons for Elementor"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=elementor_ajax"; nocase; content:"theplus_hover_card"; nocase; pcre:"/(<script|onerror|onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Hover Card widget in The Plus Addons for Elementor settings.
2. Review all pages/posts created by contributors for malicious content.
3. Implement a Web Application Firewall (WAF) with XSS rules.

Long-term Fix:

• Apply input sanitization and output escaping to all widget attributes.
• Update to a patched version when released by the vendor.
• Consider using a security plugin like Wordfence to block XSS attempts.

Workaround:

• Restrict contributor-level access to only trusted users.
• Use a Content Security Policy (CSP) header: default-src 'self'; script-src 'self' 'unsafe-inline' (note: unsafe-inline weakens security but may be needed for Elementor).

Valters IT
DevSecOps & Cyber Threat Intelligence