CVE-2024-12043
📋 TL;DR
This stored XSS vulnerability in the Prime Slider WordPress plugin allows authenticated attackers with Contributor access or higher to inject malicious scripts into website pages. The scripts execute whenever users visit compromised pages, potentially stealing credentials or performing unauthorized actions. All WordPress sites using vulnerable plugin versions are affected.
💻 Affected Systems
- Prime Slider – Addons For Elementor (WordPress plugin)
📦 What is this software?
Prime Slider by Bdthemes
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, deface websites, redirect users to malicious sites, or install backdoors for persistent access.
Likely Case
Attackers with contributor accounts inject malicious scripts to steal user session cookies or credentials, potentially compromising user accounts.
If Mitigated
With proper input validation and output escaping, no script injection would occur, limiting impact to data integrity issues.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once an attacker has Contributor-level credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.16.6 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Prime Slider – Addons For Elementor'. 4. Click 'Update Now' if available, or download version 3.16.6+ from WordPress repository. 5. Activate updated plugin.
🔧 Temporary Workarounds
Disable vulnerable widget
allRemove or disable the 'blog' widget from Elementor to prevent exploitation via social_link_title parameter.
Restrict user roles
allTemporarily remove Contributor role access or implement stricter role-based access controls.
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block XSS payloads targeting social_link_title parameter
- Disable the Prime Slider plugin entirely until patching is possible
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins → Prime Slider version. If version is 3.16.5 or lower, system is vulnerable.Check Version:
wp plugin list --name='bdthemes-prime-slider-lite' --field=versionVerify Fix Applied:
Verify plugin version is 3.16.6 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to wp-admin/admin-ajax.php with social_link_title parameter containing script tags
- Multiple failed login attempts followed by successful Contributor-level login
Network Indicators:
- Outbound connections to suspicious domains from WordPress site
- Unexpected JavaScript execution in blog widget pages
SIEM Query:
source="wordpress.log" AND ("social_link_title" AND ("<script" OR "javascript:" OR "onerror="))