CVE-2024-3199

Executive Summary

CVE-2024-3199 is a Stored Cross-Site Scripting (XSS) vulnerability in the The Plus Addons for Elementor WordPress plugin, affecting all versions up to and including 5.4.2. The flaw resides in the countdown widget, where insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses a page containing the malicious widget.

This vulnerability is specific to the WordPress ecosystem and does not affect Apache or Nginx directly. The plugin is widely used to extend Elementor page builder functionality, making this a significant supply chain risk for WordPress sites.

Supply Chain & Package Security

This vulnerability is part of the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Users should verify plugin integrity by checking checksums provided by the repository. No known malicious packages have been reported, but the lack of a patch increases the risk of supply chain attacks through compromised plugin updates.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor)
• User Interaction: Required (Victim visits page)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is elevated due to the low privileges required and the potential for widespread exploitation via social engineering. The EPSS score of 0.0% suggests low current exploitation, but this may change as proof-of-concept code emerges.

Deep Dive & Mechanics

The vulnerability exists in the countdown widget of The Plus Addons for Elementor. The widget accepts user input for countdown parameters (e.g., date, time, labels) without proper sanitization or output escaping. When a contributor or higher-level user creates or edits a page using this widget, they can inject malicious JavaScript into these fields.

The injected script is stored in the WordPress database and rendered on the frontend without escaping. When any user (including administrators) visits the page, the script executes in their browser context, potentially leading to session hijacking, defacement, or data theft.

The root cause is the failure to apply WordPress's built-in escaping functions (e.g., esc_attr(), esc_html(), wp_kses_post()) to user-supplied data before outputting it in the widget's HTML.

Vulnerable vs. Patched Code

Vulnerable Code (<= 5.4.2):

// In countdown widget render method
echo '<div class="countdown-timer" data-date="' . $settings['countdown_date'] . '">';
// No escaping on $settings['countdown_date']

Patched Code (Hypothetical):

// In countdown widget render method
echo '<div class="countdown-timer" data-date="' . esc_attr($settings['countdown_date']) . '">';
// Properly escaped

The patch would require applying esc_attr() to all user-controlled attributes and esc_html() or wp_kses_post() to any HTML content output by the widget.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with The Plus Addons for Elementor <= 5.4.2
• Contributor-level account or higher
• Elementor page builder enabled

Exploitation Steps:

1. Log in as a contributor.
2. Create a new page or edit an existing one using Elementor.
3. Add the "Countdown" widget from The Plus Addons.
4. In the countdown date field, inject the following payload:

   "><script>alert('XSS')</script>
   

5. Save and publish the page.
6. When any user visits the page, the script executes.

Advanced Payload:

2024-12-31 23:59:59" onfocus="alert(1)" autofocus="true

Blue Team

Detection:

• Monitor for unusual countdown widget configurations in Elementor.
• Check for JavaScript payloads in post meta fields related to theplus_countdown.
• Use WAF rules to block common XSS patterns in POST requests to wp-admin/admin-ajax.php or Elementor endpoints.

Hunting:

• Query the WordPress database for posts containing <script tags in post_content or post_meta where the meta key contains theplus.
• Review Elementor revisions for injected scripts.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/the-plus-addons-for-elementor/
• Database: Posts with post_content containing <script> tags in countdown widget output.
• Network: Outbound connections to attacker-controlled domains from compromised pages.
• Logs: Unusual Elementor AJAX requests with encoded payloads.
• User Agent: Any browser accessing pages with injected scripts.

Detection Engineering

YARA Rule

rule detect_cve_2024_3199_xss {
    meta:
        description = "Detects stored XSS payloads in The Plus Addons for Elementor countdown widget"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-3199"
    strings:
        $payload1 = /<script[^>]*>.*<\/script>/is
        $payload2 = /on\w+\s*=\s*["'][^"']*["']/i
        $widget = /theplus_countdown/i
    condition:
        $widget and ($payload1 or $payload2)
}

Sigma Rule

title: Stored XSS via The Plus Addons for Elementor Countdown Widget
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects stored XSS attempts in WordPress posts using The Plus Addons for Elementor
author: Valters IT
date: 2024-01-01
logsource:
    category: application
    product: wordpress
detection:
    selection:
        post_content|contains: 
            - 'theplus_countdown'
            - '<script'
            - 'onerror'
            - 'onload'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in posts by administrators
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-3199 Stored XSS in The Plus Addons for Elementor"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"theplus_countdown"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable The Plus Addons for Elementor plugin until a patch is available.
2. Review all pages using the countdown widget for injected scripts.
3. Remove any malicious content from the database.

Long-term Fix:

• Apply the vendor patch when released (currently UNKNOWN).
• Upgrade to version > 5.4.2 if available.

Compensating Controls:

• Implement a Web Application Firewall (WAF) with XSS rules.
• Restrict contributor-level access to trusted users only.
• Enable WordPress automatic updates for plugins.
• Use security plugins like Wordfence to monitor for XSS attempts.

Valters IT - DevSecOps & Cyber Threat Intelligence Expert