CVE-2024-2655 in Elementor Addons Plugin
Summary
by MITRE • 04/10/2024
The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Post widgets in all versions up to, and including, 8.3.5 due to insufficient input sanitization and output escaping on author display names. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/07/2025
The vulnerability identified as CVE-2024-2655 affects the Elementor Addons by Livemesh plugin for WordPress, specifically targeting versions up to and including 8.3.5. This represents a critical security flaw that enables stored cross-site scripting attacks through the plugin's Post widgets functionality. The vulnerability arises from inadequate input sanitization and output escaping mechanisms when handling author display names within the plugin's interface.
The technical flaw stems from the plugin's failure to properly sanitize user-supplied input when displaying author names in the Post widgets. When authenticated users with contributor-level privileges or higher create or modify content, they can inject malicious JavaScript code into the author display name field. This code then gets stored within the WordPress database and executed whenever any user accesses pages containing the affected widgets. The vulnerability operates as a stored XSS attack because the malicious payload persists in the database rather than being reflected in a single HTTP request.
The operational impact of this vulnerability is significant for WordPress sites utilizing the affected plugin. Attackers with contributor-level access can exploit this weakness to execute arbitrary JavaScript code in the context of any user's browser who views pages containing the malicious content. This could enable attackers to steal session cookies, redirect users to malicious websites, deface content, or perform other malicious actions. The vulnerability affects all users who have access to the plugin's Post widgets functionality, making it particularly dangerous in environments where multiple contributors have administrative privileges.
From a cybersecurity perspective, this vulnerability aligns with CWE-79, which describes Cross-Site Scripting flaws in web applications. The issue also maps to ATT&CK technique T1566.001, which involves social engineering through malicious content injection. The vulnerability demonstrates poor input validation practices and inadequate output escaping, which are fundamental security principles that should be implemented in all web applications processing user input. Organizations using this plugin should immediately update to the latest version to mitigate this risk, as the vulnerability affects all versions up to 8.3.5 and provides attackers with a persistent means of executing malicious code.
The exploitation of this vulnerability requires minimal privileges, making it particularly concerning for WordPress installations where multiple users have contributor access or higher. The stored nature of the attack means that even users who do not directly interact with the malicious content can be compromised when they visit pages containing the injected scripts. Security teams should implement immediate monitoring for suspicious activity related to the Elementor Addons plugin and consider implementing additional security measures such as content security policies to mitigate the potential impact of such attacks.