CVE-2024-4580 – This vulnerability allows authenticated WordPre... (How to Fix)

Q: What is the severity of CVE-2024-4580?

CVE-2024-4580 has a CVSS score of 6.4 (MEDIUM). This vulnerability allows authenticated WordPress users with contributor-level permissions or higher to inject malicious scripts into website pages through the Master Addons plugin. The injected scripts execute whenever users view the compromised pages, enabling attackers to steal session cookies, redirect users, or deface websites. All WordPress sites using Master Addons plugin versions up to 2.0.6.0 are affected.

📋 TL;DR

This vulnerability allows authenticated WordPress users with contributor-level permissions or higher to inject malicious scripts into website pages through the Master Addons plugin. The injected scripts execute whenever users view the compromised pages, enabling attackers to steal session cookies, redirect users, or deface websites. All WordPress sites using Master Addons plugin versions up to 2.0.6.0 are affected.

💻 Affected Systems

Products:

Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor WordPress plugin

Versions: Up to and including version 2.0.6.0

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WordPress with Elementor page builder and the Master Addons plugin installed. Contributor-level or higher user accounts are needed for exploitation.

📦 What is this software?

Master Addons by Master Addons

View all CVEs affecting Master Addons →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could steal administrator session cookies, gain full administrative access, install backdoors, deface websites, or redirect users to malicious sites, potentially leading to complete site compromise and data theft.

🟠

Likely Case

Attackers with contributor accounts inject malicious scripts to steal user session cookies, perform phishing attacks, or deface specific pages, potentially compromising user accounts and damaging site reputation.

🟢

If Mitigated

With proper user access controls and content review processes, the impact is limited to potential page defacement or minor script injection that can be quickly detected and removed.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated access with contributor permissions. Public proof-of-concept exists in vulnerability reports and code changesets.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Version 2.0.6.1 or later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3087193/

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Master Addons for Elementor'. 4. Click 'Update Now' if available. 5. Alternatively, download latest version from WordPress repository and manually update.

🔧 Temporary Workarounds

Temporary Plugin Deactivation

all

Disable the Master Addons plugin until patched to prevent exploitation

wp plugin deactivate master-addons

User Role Restriction

all

Temporarily restrict contributor-level users from editing posts/pages

Use WordPress role management plugins or custom code to modify capabilities

🧯 If You Can't Patch

Implement strict user access controls and review all content from contributor-level users
Deploy web application firewall (WAF) rules to detect and block XSS payloads in plugin parameters

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → Installed Plugins, find Master Addons, verify version is 2.0.6.0 or lower

Check Version:

wp plugin get master-addons --field=version

Verify Fix Applied:

After updating, verify Master Addons plugin version is 2.0.6.1 or higher in WordPress plugins list

📡 Detection & Monitoring

Log Indicators:

Unusual post/page edits from contributor accounts
Script tags containing malicious code in post content
Multiple failed login attempts followed by successful contributor login

Network Indicators:

Outbound connections to suspicious domains from your website
Unexpected script loads in page responses

SIEM Query:

source="wordpress.log" AND ("master-addons" OR "ma-image-hover-effects" OR "ma-tabs") AND ("script" OR "onerror" OR "javascript:")

📊 Metadata

CVE ID: CVE-2024-4580

CVSS v3 Score: 6.4 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

CWE: CWE-79

Published: May 16, 2024

Last Updated: January 30, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-4580, you might also want to check these: