Stored XSS in Prime Elementor Addons WordPress Plugin

Detection Guidance

This vulnerability involves stored cross-site scripting via Widget HTML Tag Settings in the Prime Elementor Addons plugin for WordPress. Detection involves identifying injected scripts in pages created or edited by users with contributor-level access or above.

Since the payload does not contain HTML angle brackets and bypasses typical filters, detection requires inspecting the HTML tag settings of Elementor widgets for suspicious attributes such as onerror or other event handlers embedded in image tags or similar elements.

There are no specific commands provided in the available resources or CVE description to detect this vulnerability automatically.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the Prime Elementor Addons plugin to a version later than 1.3.3 where this vulnerability is fixed.

If an update is not immediately available, restrict contributor-level and higher user access to trusted users only, as the exploit requires authenticated users with at least contributor privileges.

Additionally, monitor and sanitize any HTML tag settings in Elementor widgets to remove suspicious scripts or event handlers that could be used for cross-site scripting.

Useful 0 Not Useful 0

Executive Summary

The Prime Elementor Addons – Lightweight Elementor Widgets for Faster Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the Widget HTML Tag Settings in all versions up to and including 1.3.3.

This vulnerability exists because the plugin does not properly sanitize input or escape output, allowing authenticated users with contributor-level access or higher to inject arbitrary web scripts into pages.

These injected scripts execute whenever any user accesses the affected page, potentially compromising user security.

The exploit works even if the attacker lacks the unfiltered_html capability because the malicious payload can be crafted without HTML angle brackets, bypassing Elementor's wp_kses_post() filter.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers with contributor-level access to inject malicious scripts into web pages.

When users visit these compromised pages, the malicious scripts execute in their browsers, which can lead to theft of sensitive information, session hijacking, or other malicious actions.

Because the attack requires only contributor-level access, it increases the risk from insider threats or compromised accounts with limited privileges.

Overall, this can lead to a loss of user trust, data breaches, and potential damage to the website's reputation.

Useful 0 Not Useful 0