The WordPress ecosystem faces a new challenge as advisories for eleven Elementor add-on plugins have been released, uncovering 15 vulnerabilities that could potentially allow hackers to upload malicious files. Among these, a critical vulnerability stands out due to its potential to permit hackers to bypass access controls, execute scripts, and gain access to sensitive information.
Two Distinct Types of Vulnerabilities Identified:
- Stored Cross-Site Scripting (XSS): The majority of these vulnerabilities are classified as XSS, arising from improper sanitization of input data and incorrect securing of output data.
- Local File Inclusion (LFI): Three vulnerabilities are identified as LFI, exploiting insecure user input fields to allow attackers to include malicious files in the input.
Advisories highlight vulnerabilities across eleven Elementor addon plugins:
- High Severity: One plugin contains a vulnerability rated as high severity.
- Medium Severity: The remaining plugins are rated with medium severity vulnerabilities.
List of Vulnerable Elementor Add-On Plugins with CVEs:
ElementsKit Elementor Add Ons Vulnerabilities
- CVE-2024-1238: An authenticated (Contributor+) Stored Cross-Site Scripting (XSS) vulnerability, allowing contributors to inject malicious scripts.
- CVE-2024-2047: An authenticated (Contributor+) Local File Inclusion (LFI) vulnerability within the render_raw function. Rated as HIGH THREAT with a severity of 8.8, this vulnerability permits the inclusion and execution of arbitrary files on the server, posing a significant security risk.
Unlimited Elements for Elementor Vulnerability
- CVE-2024-0367: This vulnerability allows authenticated (Contributor+) users to perform Stored XSS via Widget Link, potentially leading to script execution.
140+ Widgets | Best Addons for Elementor – FREE Vulnerability
- CVE-2024-2250: A Stored XSS vulnerability accessible by authenticated (Contributor+) users, allowing script injection via the plugin.
Better Elementor Add-Ons Vulnerability
- CVE-2024-2280: Similar to the previous, this Stored XSS vulnerability through widget links can be exploited by contributors, enabling the injection of malicious scripts.
Elementor Addon Elements Vulnerabilities
- CVE-2024-2091: Stored Cross-Site Scripting vulnerability for authenticated (Contributor+) users, allowing script injection.
- CVE-2024-2792: DOM-Based Stored XSS affecting versions up to 1.13.2, exploitable via ‘Text Separator’ and ‘Image Compare’ widgets.
Master Addons for Elementor Vulnerability
- CVE-2024-2139: Contributors with access can exploit this Stored XSS vulnerability through the Pricing Table Widget.
The Plus Addons for Elementor Vulnerabilities
- CVE-2024-2210 and CVE-2024-2203: Both are Local File Inclusion vulnerabilities that can be exploited by authenticated (Contributor+) users via specific widgets (Team Member Listing and Clients Widget), posing a threat of unauthorized file inclusion.
Essential Addons for Elementor Vulnerabilities
- CVE-2024-2623 and CVE-2024-2650: Stored XSS vulnerabilities exploitable by contributors, specifically via the countdown widget’s message parameter and the alignment parameter in the Woo Product Carousel widget, respectively.
Recommendations for Mitigation:
- Immediate Updates: Website administrators should promptly update all vulnerable plugins to the latest versions that have addressed these issues.
- Review User Permissions: Limit the number of users with contributor or higher-level access to reduce the risk of exploitation.
- Regular Security Audits: Conduct regular security audits of the WordPress site, including plugins and themes, to identify and mitigate potential vulnerabilities.
- Implement Security Measures: Utilize web application firewalls (WAFs) and other security solutions to provide an additional layer of protection against potential exploits.
Given the breadth of these vulnerabilities and their potential impact, it’s crucial for administrators of WordPress sites using these Elementor addons to take immediate action to secure their sites.
The discovery of these vulnerabilities serves as a reminder of the persistent security challenges within the WordPress community. It emphasizes the importance of ongoing vigilance, prompt updates, and the proactive management of security risks by website administrators.
