CVE-2024-5583

Executive Summary

CVE-2024-5583 is a Stored Cross-Site Scripting (XSS) vulnerability in the The Plus Addons for Elementor WordPress plugin (versions up to and including 5.6.2). The flaw resides in the carousel_direction parameter of the testimonials widget. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. When a user visits a page containing the maliciously crafted widget, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or further compromise of the WordPress site.

This vulnerability is specific to the WordPress ecosystem and does not affect Apache or Nginx directly. The plugin is widely used for building Elementor-based pages, making this a high-impact issue for sites with multiple authors or contributors.

Supply Chain & Package Security

This is a WordPress plugin vulnerability. The plugin is distributed via the WordPress plugin repository and can be installed directly from the WordPress admin dashboard. Users should verify they are running version 5.6.3 or later once a patch is released. No official patch has been confirmed at this time.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: Required (Victim must visit the page)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The threat level is elevated due to the low privileges required and the potential for widespread exploitation across sites using the plugin. The EPSS score of 0.0% suggests no active exploitation in the wild at the time of analysis, but this may change.

Deep Dive & Mechanics

The vulnerability is in the theplus_testimonials widget, specifically in how the carousel_direction attribute is processed. The plugin uses esc_attr() for some attributes but fails to properly sanitize or escape the carousel_direction parameter when rendering the widget's HTML output. This allows an attacker to inject JavaScript code that is stored in the database and executed when the page is loaded.

The attack flow:

1. An authenticated user with contributor-level access creates or edits a page using the Elementor builder.
2. The attacker adds the testimonials widget and sets the carousel_direction parameter to a malicious payload, e.g., " onmouseover="alert(1)".
3. The plugin stores this value without proper sanitization.
4. When any user (including administrators) visits the page, the injected script executes in their browser context.

The root cause is insufficient input validation and output escaping on user-supplied attributes in the widget's rendering function.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 5.6.2):

// In the widget's render method
$carousel_direction = $settings['carousel_direction'];
echo '<div class="testimonials-list" data-direction="' . $carousel_direction . '">';

Patched Code (hypothetical fix):

// Properly escape the attribute
$carousel_direction = esc_attr($settings['carousel_direction']);
echo '<div class="testimonials-list" data-direction="' . $carousel_direction . '">';

The fix involves using esc_attr() or wp_kses() to sanitize the attribute before output. Additionally, the plugin should validate that the value is one of the expected options (e.g., "left", "right", "up", "down").

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with The Plus Addons for Elementor <= 5.6.2
• Contributor-level account or higher
• Elementor page builder enabled

Exploitation Steps:

1. Log in as a contributor.
2. Create a new page or edit an existing one with Elementor.
3. Add the "Testimonials" widget to the page.
4. In the widget settings, locate the carousel_direction field.
5. Inject a payload such as:

   " onmouseover="alert(document.cookie)
   

   or

   " onfocus="alert(1)" autofocus="
   

6. Save the page.
7. Send the page link to a target user. When they hover over or interact with the element, the script executes.

Proof-of-Concept (PoC) Code:

<!-- This is a simplified representation; actual injection occurs via Elementor UI -->
<div class="testimonials-list" data-direction="" onmouseover="alert('XSS')">

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual carousel_direction values in the wp_postmeta table.
• Look for Elementor widget settings containing script tags or event handlers.
• Use WAF rules to block common XSS payloads in POST requests to Elementor endpoints.

Hardening:

• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Use a WordPress security plugin that monitors file changes and plugin updates.
• Apply the vendor patch as soon as it becomes available.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/the-plus-addons-for-elementor/ (check for modified files)
• Database: wp_postmeta entries with meta_key containing _elementor_data and meta_value containing suspicious carousel_direction values.
• Network: HTTP requests to Elementor endpoints with unusual carousel_direction parameters.
• Logs: WordPress debug logs showing unexpected script execution or errors in widget rendering.

Detection Engineering

YARA Rule

rule CVE_2024_5583_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in The Plus Addons for Elementor testimonials widget"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-5583"
    strings:
        $xss_payload = /carousel_direction["']?\s*[:=]\s*["'][^"']*["']?\s*on\w+=/i
        $xss_script = /<script[^>]*>.*<\/script>/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-5583 Stored XSS in The Plus Addons for Elementor
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects stored XSS attempts via carousel_direction parameter in testimonials widget
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url|contains: /wp-admin/admin-ajax.php
        http.body|contains: carousel_direction
        http.body|re: (on\w+=|javascript:|<script)
    condition: selection
falsepositives:
    - Legitimate use of carousel_direction with safe values
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-5583 - Stored XSS in The Plus Addons for Elementor";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"carousel_direction"; http_client_body;
    pcre:"/(on\w+=|javascript:|<script)/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-5583;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the testimonials widget or the entire plugin if no patch is available.
2. Restrict contributor-level accounts to only trusted users.
3. Implement a Web Application Firewall (WAF) rule to block XSS payloads in Elementor widget settings.

Long-term Fix:

• Update to version 5.6.3 or later once the vendor releases a patch.
• Apply the fix by adding proper input sanitization and output escaping to the carousel_direction parameter.

Workaround:

• Use a WordPress security plugin to monitor and block malicious input.
• Manually edit the plugin file (not recommended) to add esc_attr() around the vulnerable parameter.

Valters IT
Securing Digital Frontiers