CVE-2024-1419 in Plus Addons for Elementor Plugin
Summary
by MITRE • 03/07/2024
The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_id’ attribute of the Header Meta Content widget in all versions up to, and including, 5.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 04/12/2026
The vulnerability identified as CVE-2024-1419 affects the Plus Addons for Elementor plugin, a popular WordPress extension that enhances the functionality of the Elementor page builder. This plugin has been widely adopted by website administrators and developers seeking to extend their WordPress sites with additional widgets and features. The specific flaw resides within the Header Meta Content widget, which is part of the plugin's extensive suite of tools designed to manage meta information for web pages. The vulnerability impacts all versions of the plugin up to and including version 5.4.0, making it a significant concern for numerous WordPress installations that have not yet updated to newer releases.
The technical root cause of this vulnerability stems from inadequate input sanitization and output escaping mechanisms within the plugin's codebase. The vulnerability specifically targets the '_id' attribute of the Header Meta Content widget, where user-supplied data is not properly validated or escaped before being stored and subsequently rendered in web pages. This failure to implement proper security measures creates a condition where malicious input can be persisted in the database and executed when pages are accessed. The vulnerability classifies as a stored cross-site scripting attack because the malicious script is stored on the server and executed whenever users access affected pages, rather than being transmitted through a single request.
The operational impact of this vulnerability is particularly concerning given that it requires only contributor-level access or higher to exploit, which represents a relatively low barrier for attackers. Contributors in WordPress typically have the ability to create and edit posts, as well as manage their own content, making this a dangerous vulnerability for sites where multiple users have contributor privileges. Attackers can leverage this vulnerability to inject malicious scripts that could perform various harmful actions including but not limited to stealing user session cookies, redirecting visitors to malicious websites, defacing pages, or executing unauthorized administrative actions. The stored nature of the vulnerability means that the malicious code persists even after the initial injection, allowing attackers to maintain access and continue their activities over extended periods.
This vulnerability aligns with CWE-79, which describes Cross-Site Scripting (XSS) flaws that occur when untrusted data is sent to a web browser without proper validation or escaping. The attack vector follows patterns consistent with the ATT&CK framework's technique T1059.005, which involves the use of command and scripting interpreters for execution. The flaw represents a critical security weakness that can be exploited by attackers who have gained contributor-level access through various means such as credential compromise, social engineering, or other initial access vectors. The vulnerability's impact extends beyond simple script execution as it can serve as a foothold for more sophisticated attacks, potentially allowing attackers to escalate privileges or establish persistent access to affected WordPress installations.
Organizations and website administrators should prioritize immediate remediation by updating to the latest version of the Plus Addons for Elementor plugin where this vulnerability has been addressed. The recommended mitigation strategy includes implementing strict access controls and limiting contributor privileges to only trusted users who require such permissions. Additionally, regular security audits of WordPress plugins and themes should be conducted to identify and remediate similar vulnerabilities before they can be exploited. Site administrators should also consider implementing Content Security Policies to provide an additional layer of protection against XSS attacks, though this should not be considered a substitute for proper input validation and output escaping mechanisms. Regular monitoring of plugin updates and maintaining an inventory of installed WordPress extensions will help ensure that security patches are applied promptly to protect against known vulnerabilities.