CVE-2024-47392
📋 TL;DR
This stored cross-site scripting (XSS) vulnerability in the Element Pack Elementor Addons WordPress plugin allows attackers to inject malicious scripts into web pages. When users view pages containing the malicious content, the scripts execute in their browsers, potentially stealing credentials or performing unauthorized actions. All WordPress sites using vulnerable versions of this plugin are affected.
💻 Affected Systems
- BdThemes Element Pack Elementor Addons WordPress plugin
📦 What is this software?
Element Pack by Bdthemes
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, take over WordPress sites, deface websites, or redirect visitors to malicious sites, potentially compromising all site data and user information.
Likely Case
Attackers inject malicious JavaScript that steals user session cookies or credentials when users visit compromised pages, leading to account takeover and unauthorized access.
If Mitigated
With proper input validation and output encoding, malicious scripts would be neutralized before reaching users' browsers, preventing execution.
🎯 Exploit Status
Stored XSS vulnerabilities are commonly exploited. While no public PoC is mentioned, the vulnerability type is well-understood and easily weaponized.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 5.7.5
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Element Pack Elementor Addons'. 4. Click 'Update Now' if available. 5. If no update is available, deactivate and delete the plugin, then install the latest version from WordPress repository.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily deactivate the Element Pack Elementor Addons plugin until patched
wp plugin deactivate bdthemes-element-pack-lite
Implement Content Security Policy
allAdd CSP headers to restrict script execution sources
Add to .htaccess: Header set Content-Security-Policy "default-src 'self'; script-src 'self'"
Or add to WordPress functions.php: header("Content-Security-Policy: default-src 'self'; script-src 'self'");
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block XSS payloads
- Restrict plugin access to trusted users only and monitor for suspicious content changes
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for 'Element Pack Elementor Addons' version 5.7.5 or earlierCheck Version:
wp plugin get bdthemes-element-pack-lite --field=versionVerify Fix Applied:
Verify plugin version is higher than 5.7.5 in WordPress admin panel📡 Detection & Monitoring
Log Indicators:
- Unusual plugin file modifications
- Suspicious POST requests to plugin endpoints
- Administrative actions from unexpected IPs
Network Indicators:
- Malicious script injections in HTTP responses
- Unexpected external script loads
SIEM Query:
source="wordpress.log" AND ("element-pack" OR "bdthemes") AND ("POST" OR "UPDATE") AND ("script" OR "javascript" OR "onload" OR "onerror")