CVE-2024-9668

Executive Summary

CVE-2024-9668 is a Stored Cross-Site Scripting (XSS) vulnerability in the Royal Elementor Addons and Templates plugin for WordPress. The flaw resides in the plugin's Countdown widget, where user-supplied attributes are not properly sanitized or escaped. This allows authenticated attackers with at least Contributor-level access to inject arbitrary web scripts. When a site administrator or visitor loads a page containing the malicious widget, the injected script executes in their browser, potentially leading to session hijacking, defacement, or data theft.

The vulnerability affects all versions up to and including 1.7.1001. No official patch has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant for sites with untrusted contributors.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The Royal Elementor Addons plugin is distributed via the official WordPress plugin repository. Users should monitor for updates and consider removing the plugin if no patch is forthcoming.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires authentication but is easy to exploit once access is obtained. The impact is limited to script injection, but combined with social engineering, it can lead to privilege escalation.

Deep Dive & Mechanics

The Royal Elementor Addons plugin provides a Countdown widget that allows users to set a timer with custom attributes. The vulnerability arises because the plugin does not properly sanitize or escape user-supplied attributes before rendering them in the HTML output. An attacker with Contributor-level access can craft a Countdown widget with malicious JavaScript in an attribute (e.g., data-* or class). When the widget is rendered on a page, the script executes in the context of the victim's browser.

Root Cause: Insufficient input validation and output escaping in the Countdown widget's attribute handling. The plugin likely uses echo or print without esc_attr() or wp_kses().

Attack Flow:

1. Attacker logs in as a Contributor.
2. Creates a new page or post and adds the Countdown widget.
3. Injects a malicious payload into a widget attribute (e.g., data-custom="<script>alert('XSS')</script>").
4. Publishes or saves the page.
5. When an admin or visitor views the page, the script executes.

Vulnerable vs. Patched Code

Vulnerable Code (hypothetical example):

// In countdown-widget.php
$custom_attr = $settings['custom_attribute'];
echo '<div class="countdown-timer" data-custom="' . $custom_attr . '">';

Patched Code (expected):

$custom_attr = esc_attr($settings['custom_attribute']);
echo '<div class="countdown-timer" data-custom="' . $custom_attr . '">';

The patched version would use esc_attr() to escape the attribute value, preventing script injection. Since no official patch exists, users must manually apply similar escaping or remove the plugin.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Royal Elementor Addons <= 1.7.1001.
• Contributor-level account.

Steps:

1. Log in as a Contributor.
2. Navigate to Pages > Add New.
3. Add the "Countdown" widget from Elementor.
4. In the widget settings, locate a text field (e.g., "Custom CSS Class" or "Custom Attribute").
5. Inject payload: "><script>alert(document.cookie)</script>
6. Save and publish the page.
7. When an admin visits the page, the script executes.

Proof-of-Concept (No public exploit available):

<!-- Injected via widget attribute -->
<div class="countdown-timer" data-custom=""><script>alert('XSS')</script>">

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual widget attribute values in page/post content.
• Use Web Application Firewall (WAF) rules to block <script> tags in widget fields.
• Review logs for Contributor-level users creating pages with Elementor widgets.

Hardening:

• Restrict Contributor-level access to trusted users only.
• Disable the Countdown widget if not needed.
• Apply a virtual patch via WAF to block XSS payloads in widget attributes.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/royal-elementor-addons/ (presence of vulnerable version)
• Database: Posts/pages containing <script> tags in post_content or post_meta for Elementor widgets.
• Network: Outbound connections from injected scripts (e.g., to attacker-controlled domains).
• Logs: Elementor widget creation events by non-admin users.

Detection Engineering

YARA Rule

rule CVE_2024_9668_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Royal Elementor Addons Countdown widget"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-9668"
    strings:
        $payload1 = /<script[^>]*>.*<\/script>/i
        $payload2 = /on\w+\s*=\s*["']?[^"']*["']?/i
        $widget = "countdown-timer"
    condition:
        $widget and ($payload1 or $payload2)
}

Sigma Rule

title: CVE-2024-9668 - Stored XSS via Royal Elementor Addons Countdown Widget
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects creation of pages/posts with malicious Elementor widget attributes
author: Valters IT
date: 2025-04-10
logsource:
    product: wordpress
    service: audit
detection:
    selection:
        EventID: 1000  # Example: post creation
        PostContent|contains: 
            - 'countdown-timer'
            - '<script'
            - 'onerror'
            - 'onload'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in widgets (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-9668 - Stored XSS in Royal Elementor Addons Countdown Widget"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=elementor_ajax"; nocase; content:"countdown-timer"; nocase; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if the Countdown widget is not critical.
2. Restrict Contributor roles to only trusted users.
3. Apply a virtual patch using a WAF to block XSS payloads in widget attributes.

Long-term Fix:

• Monitor the plugin's official page for a patched version.
• If no patch is released, consider replacing the plugin with an alternative.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Workaround:

• Manually edit the plugin's code to add esc_attr() to all widget attributes (requires developer skills).

Valters IT