CVE-2024-5763

Executive Summary

CVE-2024-5763 is a Stored Cross-Site Scripting (XSS) vulnerability in the The Plus Addons for Elementor WordPress plugin, affecting all versions up to and including 5.6.2. The flaw resides in the plugin's Video widget, specifically within the video_date attribute. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. When a user accesses a page containing the maliciously crafted widget, the injected script executes in the context of the victim's browser. This can lead to session hijacking, credential theft, or defacement. The vulnerability is classified as a WordPress ecosystem issue and does not involve Apache or Nginx.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and third-party marketplaces. Users should verify the integrity of their plugin files and ensure they are sourced from trusted repositories. No known supply chain compromise has been reported for this CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is considered medium due to the requirement for authenticated access and the limited impact on confidentiality and integrity. However, the ability to execute arbitrary scripts in the context of other users elevates the risk in multi-tenant or high-traffic WordPress environments.

Deep Dive & Mechanics

The vulnerability exists in the Video widget of The Plus Addons for Elementor. The widget allows users to embed videos with custom attributes, including video_date. The plugin fails to properly sanitize and escape this attribute before rendering it in the HTML output. An attacker with contributor-level access can craft a malicious video_date value containing JavaScript payloads. When the widget is rendered on a page, the payload is stored in the database and executed in the browser of any user viewing that page.

The root cause is insufficient input validation and output escaping in the widget's rendering function. The video_date attribute is likely echoed directly into the HTML without being passed through WordPress's esc_attr() or similar escaping functions.

Vulnerable vs. Patched Code

Vulnerable Code (<= 5.6.2):

// In the Video widget render method
$video_date = $settings['video_date'];
echo '<div class="video-date" data-date="' . $video_date . '">' . esc_html($video_date) . '</div>';

The data-date attribute is not escaped, allowing injection of arbitrary HTML attributes or JavaScript.

Patched Code (Hypothetical):

$video_date = $settings['video_date'];
echo '<div class="video-date" data-date="' . esc_attr($video_date) . '">' . esc_html($video_date) . '</div>';

The esc_attr() function properly escapes the attribute value, preventing XSS.

Exploitation & Lab Setup

Red Team

1. Prerequisites: Authenticated access to a WordPress site with The Plus Addons for Elementor installed (version <= 5.6.2) and contributor-level privileges.
2. Steps:
   • Create a new page or edit an existing one using Elementor.
   • Add the Video widget to the page.
   • In the widget settings, locate the video_date field.
   • Inject a payload such as: " onfocus="alert(1)" autofocus="
   • Save and publish the page.
   • When any user visits the page, the script executes.

Example Payload:

" onfocus="alert(document.cookie)" autofocus="

Blue Team

1. Detection: Monitor for unusual video_date values in page content or widget settings. Look for patterns like onfocus, onload, or script tags.
2. Prevention: Ensure the plugin is updated to a patched version. If no patch is available, disable the Video widget or restrict contributor-level access.
3. Response: If exploitation is suspected, review page revisions for malicious content, remove the injected scripts, and rotate affected user sessions.

Indicators of Compromise (IOCs)

• File Indicators: Modified page/post content containing suspicious data-date attributes in Video widget HTML.
• Network Indicators: Outbound connections to attacker-controlled domains from compromised pages.
• Log Indicators: Unusual page edits by contributor-level users, especially those containing script-like patterns in widget settings.
• Behavioral: Unexpected pop-ups, redirects, or cookie theft reported by users.

Detection Engineering

YARA Rule

rule CVE_2024_5763_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in The Plus Addons for Elementor Video widget"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-5763"
    strings:
        $payload1 = /data-date\s*=\s*"[^"]*on\w+\s*=\s*[^"]*"/ nocase
        $payload2 = /data-date\s*=\s*"[^"]*<script[^>]*>/ nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-5763 Stored XSS in The Plus Addons for Elementor
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payloads in the video_date attribute of the Video widget
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "wp-content/plugins/the-plus-addons-for-elementor-page-builder"
        http.body|contains: "data-date="
        http.body|re: 'data-date\s*=\s*"[^"]*on\w+\s*=\s*[^"]*"'
    condition: selection
falsepositives:
    - Legitimate use of data-date attribute with non-malicious values
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-5763 Stored XSS in The Plus Addons for Elementor"; flow:to_server,established; content:"wp-content/plugins/the-plus-addons-for-elementor-page-builder"; http_uri; pcre:"/data-date\s*=\s*"[^"]*on\w+\s*=\s*[^"]*"/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the Video widget in The Plus Addons for Elementor until a patch is applied.
2. Update: Upgrade the plugin to version 5.6.3 or later once a patch is released.
3. Access Control: Restrict contributor-level access to trusted users only.
4. Web Application Firewall (WAF): Deploy rules to block requests containing suspicious data-date patterns.
5. Monitoring: Enable logging for page edits and review for anomalous activity.
6. User Education: Train content creators to avoid using custom attributes in widgets.

Valters IT
Securing Digital Frontiers