CVE-2024-4087

Executive Summary

CVE-2024-4087 is a Stored Cross-Site Scripting (XSS) vulnerability in the Royal Elementor Addons and Templates plugin for WordPress. The flaw resides in the plugin's "Back to Top" widget, which fails to properly sanitize user-supplied attributes and escape output. This allows authenticated attackers with at least Contributor-level access to inject arbitrary web scripts. When a victim (including administrators) visits a page containing the malicious widget, the script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability affects all versions up to and including 1.3.975. As of this report, no official patch has been released, and no public exploit code is available. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant for sites with untrusted contributors.

WordPress Ecosystem Context

This is a WordPress plugin vulnerability. The attack surface is limited to authenticated users with Contributor-level access or higher, but the impact can be severe if a contributor account is compromised or if a site allows untrusted users to publish content.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: Required (victim must visit the page)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. The vulnerability requires authentication and user interaction, but the potential for stored XSS in a widely-used plugin makes it a credible threat for WordPress sites with multiple authors.

Deep Dive & Mechanics

The "Back to Top" widget in Royal Elementor Addons allows users to customize its appearance and behavior via Elementor's interface. The widget accepts user-supplied attributes (e.g., CSS classes, custom data attributes, or inline styles) without proper sanitization or output escaping. When the widget is rendered on a page, these unsanitized attributes are injected directly into the HTML, enabling an attacker to break out of the attribute context and inject arbitrary JavaScript.

Attack Flow:

1. An attacker with Contributor-level access creates or edits a page using Elementor.
2. The attacker adds the "Back to Top" widget and injects a malicious payload into a vulnerable attribute (e.g., class or data-*).
3. The payload is stored in the WordPress database.
4. When any user (including admins) visits the page, the malicious script executes in their browser.

Root Cause: Insufficient input sanitization and output escaping on user-supplied attributes in the widget's rendering function.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common XSS remediation patterns.

Vulnerable Code (PHP):

// In widget render method
$settings = $this->get_settings_for_display();
$class = $settings['back_to_top_class']; // No sanitization
echo '<div class="' . $class . '">...</div>';

Patched Code (Hypothetical):

// In widget render method
$settings = $this->get_settings_for_display();
$class = sanitize_html_class($settings['back_to_top_class']); // Sanitize
echo '<div class="' . esc_attr($class) . '">...</div>'; // Escape output

The patched version uses sanitize_html_class() to strip dangerous characters and esc_attr() to ensure safe output in HTML attributes.

Exploitation & Lab Setup

Red Team (Proof of Concept)

Since no public exploit exists, the following is a conceptual PoC for educational purposes.

Step 1: Craft the Payload As a Contributor, create a new page in Elementor. Add the "Back to Top" widget. In a vulnerable attribute (e.g., class), inject:

" onmouseover="alert('XSS')" data-x="

Step 2: Save and Publish Save the page. The payload is stored in the database.

Step 3: Trigger When any user visits the page and hovers over the widget, the onmouseover event fires, executing the JavaScript.

Alternative Payload (Auto-execute):

" autofocus onfocus="alert('XSS')" tabindex="1" style="display:block;position:fixed;top:0;left:0;width:100%;height:100%;z-index:9999;" data-x="

This creates a full-screen overlay that auto-focuses, triggering the XSS immediately.

Blue Team (Detection & Hardening)

1. Input Validation: Implement server-side validation for all widget attributes. Use WordPress functions like sanitize_html_class(), esc_attr(), and wp_kses().
2. Content Security Policy (CSP): Deploy a strict CSP header to mitigate XSS impact:

   Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';
   

3. User Role Management: Restrict Contributor-level access to trusted users only. Consider using a plugin that limits Elementor access to specific roles.
4. Web Application Firewall (WAF): Deploy a WAF rule to block common XSS patterns in POST requests to wp-admin/admin-ajax.php and wp-admin/post.php.

Indicators of Compromise (IOCs)

• Stored Payload: Look for suspicious HTML attributes in the wp_postmeta table, specifically for the _elementor_data meta key. Example query:

  SELECT * FROM wp_postmeta WHERE meta_key = '_elementor_data' AND meta_value LIKE '%onmouseover%' OR meta_value LIKE '%onfocus%' OR meta_value LIKE '%<script%';
  

• Suspicious POST Requests: Monitor for POST requests to /wp-admin/admin-ajax.php with action=elementor_ajax and payloads containing event handlers.
• Log Entries: Check WordPress debug log for unexpected PHP warnings related to widget rendering.

Detection Engineering

YARA Rule

rule CVE_2024_4087_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads targeting Royal Elementor Addons Back to Top widget"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-4087"
    strings:
        $payload1 = /class\s*=\s*\"[^\"]*\"\s+on\w+\s*=/ nocase
        $payload2 = /data-[a-z]+\s*=\s*\"[^\"]*\"\s+on\w+\s*=/ nocase
        $payload3 = /<script\b[^>]*>/ nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-4087 Stored XSS in Royal Elementor Addons
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payloads in WordPress post meta for Royal Elementor Addons
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        meta_key: '_elementor_data'
        meta_value|contains:
            - 'onmouseover'
            - 'onfocus'
            - 'onload'
            - '<script'
    condition: selection
falsepositives:
    - Legitimate use of event handlers in custom code (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-4087 Stored XSS in Royal Elementor Addons"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=elementor_ajax"; http_client_body; pcre:"/(onmouseover|onfocus|onload|onerror)\s*=/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Back to Top widget until a patch is released. This can be done by deactivating the plugin or using a custom filter to remove the widget.
2. Restrict Contributor access to only trusted users. Audit existing Contributor accounts for suspicious activity.
3. Apply a virtual patch using a WAF to block XSS payloads in Elementor requests.

Long-term Fix:

• Monitor the plugin's official repository for a patched version (expected to be > 1.3.975). Once available, update immediately.
• Consider replacing the plugin with an alternative that has a better security track record.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.