Elementor WordPress Plugin SVG Text Content Stored XSS

Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in the Elementor Website Builder WordPress plugin versions before 4.3.5. It occurs because the plugin does not properly sanitize the text content of SVG files, only checking elements and attributes. Users with the Contributor role or higher can upload malicious SVG files containing payloads that execute when the SVG is rendered inline on a page. The execution is limited to Chromium-based browsers.

Useful 0 Not Useful 0

Detection Guidance

Check Elementor plugin version on WordPress. If below 4.3.5, the system is vulnerable. Look for uploaded SVG files with suspicious text content or payloads. Inspect browser console logs for XSS errors in Chromium-based browsers.

Useful 0 Not Useful 0

Impact Analysis

An attacker with Contributor access or higher could upload a malicious SVG file that executes arbitrary JavaScript in the browsers of users viewing the page. This could lead to session hijacking, defacement, or theft of sensitive data. The impact is limited to Chromium-based browsers.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to user data, which may violate GDPR or HIPAA requirements for data protection and confidentiality. Organizations using vulnerable versions may face compliance risks if user data is compromised.

Useful 0 Not Useful 0

Mitigation Strategies

Update Elementor plugin to version 4.3.5 or later immediately. Remove any untrusted SVG files uploaded by users with Contributor role or higher. Restrict file upload permissions to trusted users only.

Useful 0 Not Useful 0