Stored XSS in King Addons for Elementor WordPress Plugin

Executive Summary

The King Addons for Elementor plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 51.1.62. This vulnerability arises because the plugin does not properly sanitize input in the 'form_page_id' parameter. Specifically, the add_to_submissions() function uses sanitize_text_field(), which still allows double-quote characters, before storing the input in post meta. Later, the king_addons_submissions_custom_column_content() function outputs this stored value into an HTML href attribute without proper escaping (esc_url()), allowing an attacker to inject malicious scripts.

Authenticated attackers with subscriber-level access or higher can exploit this vulnerability to inject arbitrary web scripts into pages. These scripts will execute whenever a user accesses the injected page.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with subscriber-level access or above to inject malicious scripts into the website. These scripts can execute in the context of users visiting the affected pages, potentially leading to unauthorized actions such as stealing user credentials, session hijacking, defacement, or spreading malware.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves Stored Cross-Site Scripting (XSS) via the 'form_page_id' parameter in the King Addons for Elementor plugin. Detection involves checking for suspicious or malicious script injections in the stored 'form_page_id' values within the WordPress database, particularly in post meta entries.

You can inspect the WordPress database for unusual or script-containing entries in the post meta table related to King Addons submissions. For example, using a MySQL command to search for suspicious content:

• mysql -u [user] -p -e "SELECT * FROM wp_postmeta WHERE meta_key LIKE '%form_page_id%' AND meta_value LIKE '%<script>%';"

Additionally, monitoring HTTP requests for unusual parameters or payloads targeting 'form_page_id' can help detect exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately update the King Addons for Elementor plugin to a version later than 51.1.62 where the issue is fixed.

If an update is not immediately possible, restrict or review user permissions to limit subscriber-level and above users from submitting or modifying data via the vulnerable 'form_page_id' parameter.

Additionally, consider implementing Web Application Firewall (WAF) rules to block or sanitize requests containing suspicious script payloads targeting this parameter.

Finally, audit and clean any stored malicious scripts in the database to prevent execution when pages are accessed.

Useful 0 Not Useful 0