CVE-2024-12851
📋 TL;DR
This stored XSS vulnerability in Element Pack Elementor Addons allows authenticated WordPress users with Contributor access or higher to inject malicious scripts into website pages. The scripts execute whenever users visit compromised pages, potentially stealing credentials or performing unauthorized actions. All WordPress sites using this plugin up to version 5.10.14 are affected.
💻 Affected Systems
- Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows)
📦 What is this software?
Element Pack by Bdthemes
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, deface websites, redirect users to malicious sites, or install backdoors for persistent access.
Likely Case
Attackers with contributor accounts inject malicious scripts to steal user session cookies or credentials, potentially compromising user accounts.
If Mitigated
With proper user access controls and input validation, impact is limited to isolated script execution without privilege escalation.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once attacker has contributor credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.10.15 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Element Pack Elementor Addons'. 4. Click 'Update Now' if available. 5. Alternatively, download latest version from WordPress repository and replace plugin files.
🔧 Temporary Workarounds
Temporary Plugin Deactivation
allDisable the vulnerable plugin until patched
wp plugin deactivate bdthemes-element-pack-lite
Restrict User Roles
allTemporarily remove Contributor role access or restrict to trusted users only
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to limit script execution
- Add WAF rules to block XSS payloads in custom_attributes parameter
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Element Pack Elementor Addons version. If version is 5.10.14 or lower, you are vulnerable.Check Version:
wp plugin get bdthemes-element-pack-lite --field=versionVerify Fix Applied:
After update, verify plugin version is 5.10.15 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to wp-admin containing custom_attributes parameter with script tags
- Multiple failed login attempts followed by successful contributor login
Network Indicators:
- HTTP requests with script payloads in custom_attributes parameter
- Outbound connections to suspicious domains from your WordPress site
SIEM Query:
source="wordpress.log" AND ("custom_attributes" AND ("script" OR "javascript:" OR "onerror=" OR "onload="))