CVE-2024-0954 in Essential Addons for Elementor Plugin
Summary
by MITRE • 02/06/2024
The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting through editing context via the 'data-eael-wrapper-link' wrapper in all versions up to, and including, 5.9.7 due to insufficient input sanitization and output escaping on user supplied protocols. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 04/12/2026
The CVE-2024-0954 vulnerability affects the Essential Addons for Elementor WordPress plugin, specifically targeting versions up to and including 5.9.7. This security flaw represents a critical stored cross-site scripting vulnerability that exploits the plugin's handling of user-supplied data within the 'data-eael-wrapper-link' attribute. The vulnerability exists within the plugin's editing context where administrators and users with contributor-level permissions or higher can manipulate the data structure through the Elementor page builder interface. The flaw stems from inadequate input sanitization and insufficient output escaping mechanisms that fail to properly validate and sanitize user-provided protocols before rendering them in web pages. This allows malicious actors to inject malicious scripts that will execute whenever any user accesses a page containing the injected content, making it particularly dangerous in multi-user environments where privileged accounts may be compromised.
The technical implementation of this vulnerability leverages the plugin's use of the 'data-eael-wrapper-link' wrapper attribute which is designed to handle external links and protocols within Elementor templates. When users with appropriate permissions edit pages through the Elementor interface, they can manipulate this attribute to include malicious script code that gets stored in the WordPress database. The vulnerability occurs because the plugin does not properly validate the protocol portion of URLs or sanitize the input before storing it in the database. This stored data is then served back to users without proper escaping, creating a classic stored XSS vector. The attack requires minimal privileges as contributors and above can exploit this weakness, making it particularly concerning for WordPress sites with multiple user roles where less privileged users might be able to compromise the system.
The operational impact of this vulnerability extends beyond simple script execution as it provides attackers with the ability to perform a wide range of malicious activities including session hijacking, data exfiltration, and privilege escalation. When exploited, the stored XSS can be used to steal user cookies, redirect victims to malicious sites, or inject additional malicious code that could lead to complete compromise of the WordPress installation. The vulnerability affects all users who access pages containing the maliciously injected content, potentially compromising the entire user base of a website. Given that Elementor is one of the most popular page builders for WordPress, the potential attack surface is extensive, and the vulnerability could be exploited across numerous websites. The stored nature of the vulnerability means that once injected, the malicious code persists and executes automatically whenever affected pages are accessed, making detection and remediation more challenging.
Security mitigations for CVE-2024-0954 should include immediate patching of the Essential Addons for Elementor plugin to version 5.9.8 or later, which contains the necessary input validation and output escaping fixes. Organizations should also implement additional security measures such as monitoring for unauthorized changes to Elementor templates and user accounts with elevated privileges. Network-based solutions like web application firewalls can help detect and block suspicious script injections, while regular security audits should verify that no malicious code has been injected into existing pages. The vulnerability aligns with CWE-79 which specifically addresses cross-site scripting flaws, and follows ATT&CK technique T1566 for initial access through malicious content. Administrators should also consider implementing role-based access controls to limit the ability of lower-privileged users to modify critical page elements, and maintain regular backups to ensure quick recovery from potential exploitation. The incident highlights the importance of proper input validation and output escaping in web applications, particularly those handling user-generated content through content management systems.