CVE-2024-3925 in Element Pack Elementor Addons Plugin
Summary
by MITRE • 06/12/2024
The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Creative Button widget in all versions up to, and including, 5.6.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 03/24/2025
The Element Pack Elementor Addons plugin for WordPress represents a popular extension that enhances website functionality through various widgets including the Creative Button widget. This vulnerability affects all versions up to and including 5.6.7, creating a significant security risk for WordPress sites that utilize this plugin. The vulnerability stems from inadequate input sanitization and output escaping mechanisms within the plugin's codebase, specifically within the Creative Button widget implementation. Attackers with contributor-level access or higher can exploit this weakness to inject malicious scripts that persist on the server and execute whenever affected pages are accessed by other users.
The technical flaw manifests in the plugin's failure to properly validate and sanitize user-supplied attributes before processing them within the Creative Button widget. This insufficient sanitization creates a stored cross-site scripting vulnerability where malicious payloads can be permanently stored within the plugin's data structures. When legitimate users access pages containing the compromised widget, their browsers execute the injected scripts, potentially leading to session hijacking, data theft, or further exploitation. The vulnerability is particularly concerning because it requires only contributor-level privileges to exploit, which is often granted to users who should have limited administrative capabilities.
From an operational standpoint, this vulnerability poses substantial risks to WordPress site administrators and their visitors. The stored nature of the XSS attack means that once exploited, malicious scripts remain persistent on the server until manually removed, potentially affecting all users who access the compromised pages. Attackers could leverage this vulnerability to steal user sessions, redirect visitors to malicious websites, or inject additional malware into the target environment. The impact extends beyond simple script execution as it provides a foothold for more sophisticated attacks that could compromise the entire WordPress installation or lead to data breaches. This vulnerability particularly affects sites that rely heavily on Elementor page building capabilities and have multiple users with contributor-level access.
Mitigation strategies should focus on immediate plugin updates to versions that address the sanitization issues, as well as implementing additional security measures such as input validation at the application level and output escaping for all user-generated content. Administrators should also consider implementing web application firewalls to detect and block suspicious script injections, while monitoring user activities for unauthorized modifications to pages containing the Creative Button widget. Regular security audits of installed plugins should be conducted to identify similar vulnerabilities, and access controls should be carefully reviewed to limit contributor-level privileges where possible. The vulnerability aligns with CWE-79 which specifically addresses cross-site scripting flaws, and represents a clear violation of secure coding practices that should be addressed through comprehensive input validation and output encoding mechanisms. Organizations should also consider implementing the ATT&CK framework's mitigation strategies for web application attacks, particularly focusing on input validation and privilege management controls to prevent unauthorized code execution within their WordPress environments.