CVE-2024-4342 – The Royal Elementor Addons and Templates WordPr... (How to Fix)

Q: What is the severity of CVE-2024-4342?

CVE-2024-4342 has a CVSS score of 6.4 (MEDIUM). The Royal Elementor Addons and Templates WordPress plugin has a stored XSS vulnerability in multiple widgets. Authenticated attackers with contributor-level access or higher can inject malicious scripts that execute when users view affected pages. This affects all versions up to 1.3.975.

📋 TL;DR

The Royal Elementor Addons and Templates WordPress plugin has a stored XSS vulnerability in multiple widgets. Authenticated attackers with contributor-level access or higher can inject malicious scripts that execute when users view affected pages. This affects all versions up to 1.3.975.

💻 Affected Systems

Products:

Royal Elementor Addons and Templates WordPress plugin

Versions: All versions up to and including 1.3.975

Operating Systems: All

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WordPress with the vulnerable plugin installed. Attack requires authenticated user with at least contributor role.

📦 What is this software?

Royal Elementor Addons by Royal Elementor Addons

View all CVEs affecting Royal Elementor Addons →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could steal admin credentials, redirect users to malicious sites, deface websites, or perform actions on behalf of authenticated users.

🟠

Likely Case

Attackers with contributor access inject malicious scripts to steal user session cookies or perform limited site defacement.

🟢

If Mitigated

With proper user role management and content review, impact is limited to isolated script execution without privilege escalation.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires contributor-level access. The vulnerability is in multiple widgets making exploitation straightforward once authenticated.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.3.976

Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3094946/

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Royal Elementor Addons and Templates'. 4. Click 'Update Now' if available. 5. Alternatively, download version 1.3.976+ from WordPress repository and manually update.

🔧 Temporary Workarounds

Restrict User Roles

all

Limit contributor and author roles to trusted users only. Consider removing contributor access entirely if not needed.

Disable Vulnerable Widgets

all

Temporarily disable the image hotspot, image accordion, off canvas, woogrid, and product mini cart widgets in plugin settings.

🧯 If You Can't Patch

Implement strict content review process for all posts/pages created by contributors
Install a web application firewall (WAF) with XSS protection rules

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin > Plugins > Installed Plugins for Royal Elementor Addons and Templates version. If version is 1.3.975 or lower, you are vulnerable.

Check Version:

wp plugin list --name='royal-elementor-addons' --field=version

Verify Fix Applied:

After updating, verify the plugin version shows 1.3.976 or higher in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

Unusual content modifications by contributor-level users
Multiple failed login attempts followed by successful contributor login

Network Indicators:

Unexpected script tags in page responses containing 'wpr-' widget classes

SIEM Query:

source="wordpress" AND (event_type="plugin_update" AND plugin_name="royal-elementor-addons" AND old_version<="1.3.975") OR (event_type="content_edit" AND user_role="contributor" AND content_contains="<script>")

📊 Metadata

CVE ID: CVE-2024-4342

CVSS v3 Score: 6.4 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

CWE: CWE-79

Published: June 1, 2024

Last Updated: January 8, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-4342, you might also want to check these: