CVE-2024-10538 in Happy Addons for Elementor Plugin
Summary
by MITRE • 11/12/2024
The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the before_label parameter in the Image Comparison widget in all versions up to, and including, 3.12.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 02/27/2025
The vulnerability identified as CVE-2024-10538 affects the Happy Addons for Elementor WordPress plugin, specifically within the Image Comparison widget functionality. This issue represents a critical security flaw that allows authenticated attackers with Contributor-level permissions or higher to execute stored cross-site scripting attacks. The vulnerability stems from inadequate input sanitization and output escaping mechanisms within the plugin's codebase, creating a persistent security risk that can affect all WordPress installations using affected versions up to and including 3.12.5.
The technical flaw manifests through the before_label parameter within the Image Comparison widget, which fails to properly sanitize user input before storing it in the database. When an attacker with sufficient privileges creates or modifies content using this widget, malicious JavaScript code can be injected into the before_label field and subsequently stored. This stored content is then served to other users who access pages containing the vulnerable widget, executing the malicious script in their browsers. The vulnerability operates as a classic stored XSS attack pattern where the malicious input becomes part of the website's permanent content, making it particularly dangerous as it can affect any user who views the compromised pages without requiring them to take any additional action.
From an operational perspective, this vulnerability creates significant risk for WordPress sites using the Happy Addons plugin, as it enables attackers to execute arbitrary code in the context of victims' browsers. The impact extends beyond simple script execution, potentially allowing attackers to steal session cookies, redirect users to malicious sites, deface content, or perform actions on behalf of authenticated users. Since the vulnerability requires only Contributor-level access, it represents a particularly concerning risk for sites that grant editing privileges to multiple users, as a single compromised account could lead to widespread script injection across the site. The persistent nature of stored XSS means that once the malicious code is injected, it continues to execute for all users who access the affected pages until the vulnerability is patched or the malicious content is manually removed.
The security implications of this vulnerability align with CWE-79, which defines Cross-Site Scripting as a common web application vulnerability where untrusted data is improperly escaped before being returned to users. This weakness falls under the category of stored XSS attacks, where malicious scripts are stored on the server and executed when users access the compromised content. The vulnerability also maps to ATT&CK technique T1566.001, which describes social engineering through malicious content injection, as the attack vector relies on injecting malicious code that executes when legitimate users access compromised pages. Organizations should implement immediate mitigation strategies including updating to the patched version of the plugin, implementing input validation at multiple layers, and monitoring for suspicious content modifications. Additionally, access controls should be reviewed to limit the number of users with Contributor-level permissions, and regular security audits should be conducted to identify and remediate similar vulnerabilities in other plugins and themes.