CVE-2024-9694

Executive Summary

CVE-2024-9694 is a Stored Cross-Site Scripting (XSS) vulnerability in the CMSMasters Elementor Addon plugin for WordPress, affecting all versions up to and including 1.14.7. The vulnerability arises from insufficient input sanitization and output escaping on user-supplied attributes within multiple widgets. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts that execute whenever a user accesses an injected page. This can lead to session hijacking, credential theft, or defacement within the WordPress ecosystem.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. No NPM, PyPI, Go, or Ruby packages are involved. Users should verify the integrity of the plugin by checking checksums provided by the vendor or repository.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – the vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): Low – attacker needs contributor-level access.
• User Interaction (UI): Required – a user must visit the injected page.
• Scope (S): Changed – the vulnerability can impact resources beyond the vulnerable component.
• Confidentiality (C): Low – limited data exposure.
• Integrity (I): Low – limited ability to modify content.
• Availability (A): None – no impact on availability.

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the potential for widespread impact within a WordPress site (e.g., admin session theft) elevates the risk.

Deep Dive & Mechanics

The vulnerability resides in the CMSMasters Elementor Addon plugin, which extends the Elementor page builder with custom widgets. These widgets accept user-supplied attributes (e.g., title, description, link) that are rendered on the frontend without proper sanitization or escaping.

Root Cause: The plugin fails to apply WordPress's built-in escaping functions (e.g., esc_html(), esc_attr(), wp_kses_post()) to widget attributes. An attacker with contributor-level access can craft a widget instance containing malicious JavaScript in an attribute field. When the page is saved and viewed by another user, the script executes in the context of the victim's browser.

Attack Flow:

1. Attacker logs in as a contributor or higher.
2. Creates or edits a page/post using Elementor.
3. Inserts a vulnerable CMSMasters widget (e.g., "CMSMasters Heading" or "CMSMasters Button").
4. Injects a payload like "><img src=x onerror=alert('XSS')> into an attribute field.
5. Publishes the page.
6. Victim visits the page, triggering the script.

WordPress Ecosystem Context: This is a plugin-specific issue, not related to Apache or Nginx. The vulnerability is introduced by the plugin's code, not the web server.

Vulnerable vs. Patched Code

Vulnerable Code (example from a widget):

// In a widget's render() method
$title = $settings['title'];
echo '<h2>' . $title . '</h2>'; // No escaping

Patched Code (expected fix):

$title = $settings['title'];
echo '<h2>' . esc_html( $title ) . '</h2>'; // Proper escaping

The patch should apply esc_html() or esc_attr() to all user-supplied attributes before output. Since no official patch is available, users must manually apply escaping or disable the plugin.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• WordPress site with CMSMasters Elementor Addon <= 1.14.7.
• Contributor-level account or higher.

Steps:

1. Log in to WordPress admin.
2. Navigate to Pages > Add New.
3. Edit with Elementor.
4. Search for "CMSMasters" widgets.
5. Drag a vulnerable widget (e.g., "CMSMasters Heading") onto the page.
6. In the widget settings, find an attribute field (e.g., "Title").
7. Inject payload: "><img src=x onerror=alert(document.cookie)>
8. Update and publish the page.
9. Share the page URL with the victim.

Expected Result: When the victim visits the page, the JavaScript executes, displaying the victim's cookies in an alert box.

Blue Team (Defender)

Detection:

• Monitor for unusual widget attribute values in page/post revisions.
• Use WAF rules to block common XSS patterns in POST requests to /wp-admin/admin-ajax.php (Elementor's AJAX handler).
• Review user activity logs for suspicious page edits by contributors.

Mitigation:

• Disable the plugin until a patch is released.
• Apply a virtual patch via WAF (e.g., ModSecurity rule to block <script or onerror in widget attributes).
• Restrict contributor-level access to trusted users only.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/cmsmasters-elementor-addon/ (entire plugin directory)
• Database: Rows in wp_postmeta with meta_key containing _elementor_data and meta_value containing XSS payloads (e.g., <script, onerror, onload).
• Network: HTTP requests to /wp-admin/admin-ajax.php with action=elementor_ajax and payloads in data parameter.
• Logs: WordPress debug log entries showing unexpected HTML/JS in widget attributes.

Detection Engineering

YARA Rule

rule CVE_2024_9694_CMSMasters_XSS {
    meta:
        description = "Detects XSS payloads in CMSMasters Elementor Addon widget attributes"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-9694"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/is
        $xss4 = /javascript\s*:/is
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: CVE-2024-9694 - Stored XSS in CMSMasters Elementor Addon
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payloads in WordPress post meta for CMSMasters Elementor Addon
author: Valters IT
date: 2024-10-27
logsource:
    category: application
    product: wordpress
detection:
    selection:
        meta_key: '_elementor_data'
        meta_value|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in Elementor widgets (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-9694 - Stored XSS in CMSMasters Elementor Addon"; flow:to_server,established; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=elementor_ajax"; http_client_body; pcre:"/(<script|onerror|onload|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patched version is released.
2. Review and clean any pages/posts created by contributors for malicious content.
3. Reset passwords for all contributor-level accounts if compromise is suspected.

Long-term Fix:

• Apply the vendor's patch when available (check the WordPress plugin repository).
• Implement a Web Application Firewall (WAF) with rules to block XSS payloads.
• Enforce the principle of least privilege: limit contributor access to trusted users only.

Workaround:

• Manually patch the plugin by adding esc_html() or esc_attr() to all widget output functions in the plugin's PHP files (e.g., in /wp-content/plugins/cmsmasters-elementor-addon/widgets/).

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert