CVE-2024-11230 in Ultimate Addons for Elementor Plugin
Summary
by MITRE • 12/23/2024
The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘size’ parameter in all versions up to, and including, 1.6.46 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 02/16/2025
The vulnerability identified as CVE-2024-11230 affects the Elementor Header & Footer Builder plugin for WordPress, a widely used tool for creating custom headers and footers in WordPress websites. This plugin version 1.6.46 and earlier contains a critical stored cross-site scripting flaw that compromises the security of websites using it. The vulnerability stems from inadequate input validation and output escaping mechanisms within the plugin's codebase, specifically targeting the 'size' parameter which is processed during the header and footer creation process. The flaw allows authenticated attackers who possess contributor-level privileges or higher to inject malicious scripts that persist in the database and execute whenever affected pages are accessed by other users.
The technical implementation of this vulnerability occurs when the plugin fails to properly sanitize user input received through the 'size' parameter, which is typically used to define dimensions for header and footer elements. When administrators or contributors with sufficient privileges create or modify header/footer templates, the plugin stores the user-provided size values without adequate sanitization. The absence of proper output escaping means that when these stored values are later rendered on web pages, any malicious script code contained within the size parameter executes in the context of the victim's browser. This creates a persistent threat where the injected scripts can perform actions such as stealing session cookies, redirecting users to malicious sites, or executing unauthorized administrative actions on behalf of the victim.
The operational impact of this vulnerability extends beyond simple script execution as it represents a significant escalation path for attackers who have gained contributor-level access to a WordPress site. Since the vulnerability allows for stored XSS, the malicious scripts remain persistent in the database and can affect any user who accesses the affected pages, including administrators and regular site visitors. This creates a potential attack surface that could be exploited for credential theft, privilege escalation, or data exfiltration. The vulnerability affects all versions up to and including 1.6.46, meaning that a large number of WordPress sites using this plugin could be at risk, particularly those that do not maintain up-to-date security practices or have contributors with elevated privileges.
Organizations and WordPress administrators should immediately update to the latest version of the Elementor Header & Footer Builder plugin to mitigate this vulnerability, as the flaw exists in multiple versions and affects a commonly used plugin. The vulnerability aligns with CWE-79 which specifically addresses cross-site scripting flaws, and it maps to ATT&CK technique T1566.001 which covers social engineering through phishing attacks that could leverage such stored XSS vulnerabilities to establish further footholds. Mitigation strategies should include implementing strict input validation, output escaping, and access control measures to limit contributor privileges where possible. Regular security audits, monitoring of user activities, and maintaining updated security patches across all WordPress plugins and themes remain essential defensive measures against similar vulnerabilities that could compromise website integrity and user security.