CVE-2024-4489 – The Royal Elementor Addons and Templates WordPr... (How to Fix)

Q: What is the severity of CVE-2024-4489?

CVE-2024-4489 has a CVSS score of 6.4 (MEDIUM). The Royal Elementor Addons and Templates WordPress plugin has a stored XSS vulnerability that allows authenticated attackers with contributor-level permissions or higher to inject malicious scripts into web pages. These scripts execute when users visit the compromised pages, potentially leading to session hijacking, defacement, or malware distribution. WordPress sites using vulnerable plugin versions are affected.

📋 TL;DR

The Royal Elementor Addons and Templates WordPress plugin has a stored XSS vulnerability that allows authenticated attackers with contributor-level permissions or higher to inject malicious scripts into web pages. These scripts execute when users visit the compromised pages, potentially leading to session hijacking, defacement, or malware distribution. WordPress sites using vulnerable plugin versions are affected.

💻 Affected Systems

Products:

Royal Elementor Addons and Templates WordPress plugin

Versions: Up to and including version 1.3.976

Operating Systems: All

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WordPress installation with the vulnerable plugin enabled. Attacker needs at least contributor-level permissions.

📦 What is this software?

Royal Elementor Addons by Royal Elementor Addons

View all CVEs affecting Royal Elementor Addons →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could steal administrator credentials, take over the WordPress site, install backdoors, redirect users to malicious sites, or deploy ransomware payloads to visitors.

🟠

Likely Case

Attackers inject malicious JavaScript to steal user session cookies, redirect users to phishing pages, or deface website content.

🟢

If Mitigated

With proper input validation and output escaping, the vulnerability would be prevented, and only sanitized content would be displayed to users.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated access with contributor permissions or higher. The vulnerability is in the 'custom_upload_mimes' function with insufficient sanitization.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.3.977 or later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3097775/

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Royal Elementor Addons and Templates'. 4. Click 'Update Now' if available. 5. Alternatively, download version 1.3.977+ from WordPress.org and manually update.

🔧 Temporary Workarounds

Temporary Plugin Deactivation

all

Disable the vulnerable plugin until patched

wp plugin deactivate royal-elementor-addons

Restrict User Roles

all

Temporarily remove contributor and author roles or limit permissions

🧯 If You Can't Patch

Implement a Web Application Firewall (WAF) with XSS protection rules
Regularly audit user accounts and remove unnecessary contributor/author permissions

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → Royal Elementor Addons and Templates → Version number. If version ≤ 1.3.976, you are vulnerable.

Check Version:

wp plugin get royal-elementor-addons --field=version

Verify Fix Applied:

After updating, confirm plugin version is 1.3.977 or higher in WordPress admin plugins page.

📡 Detection & Monitoring

Log Indicators:

Unusual POST requests to admin-ajax.php or admin pages with script tags
Multiple failed login attempts followed by successful contributor-level login

Network Indicators:

Unexpected JavaScript payloads in HTTP requests to WordPress admin endpoints
Suspicious file uploads with script content

SIEM Query:

source="wordpress.log" AND ("custom_upload_mimes" OR "royal-elementor" OR "templates-kit.php") AND ("script" OR "javascript" OR "onload=")

📊 Metadata

CVE ID: CVE-2024-4489

CVSS v3 Score: 6.4 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

CWE: CWE-79

Published: June 7, 2024

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-4489, you might also want to check these: