CVE-2024-5001 – This stored XSS vulnerability in the Image Hove... (How to Fix)

Q: What is the severity of CVE-2024-5001?

CVE-2024-5001 has a CVSS score of 6.4 (MEDIUM). This stored XSS vulnerability in the Image Hover Effects for Elementor WordPress plugin allows authenticated attackers with Contributor access or higher to inject malicious scripts into website pages. When users visit compromised pages, the scripts execute in their browsers, potentially stealing credentials or performing unauthorized actions. All WordPress sites using this plugin up to version 3.0.2 are affected.

📋 TL;DR

This stored XSS vulnerability in the Image Hover Effects for Elementor WordPress plugin allows authenticated attackers with Contributor access or higher to inject malicious scripts into website pages. When users visit compromised pages, the scripts execute in their browsers, potentially stealing credentials or performing unauthorized actions. All WordPress sites using this plugin up to version 3.0.2 are affected.

💻 Affected Systems

Products:

Image Hover Effects for Elementor with Lightbox and Flipbox WordPress plugin

Versions: All versions up to and including 3.0.2

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires Contributor-level WordPress user access or higher to exploit. All WordPress installations using vulnerable plugin versions are affected regardless of configuration.

📦 What is this software?

Image Hover Effects For Elementor With Lightbox And Flipbox by Oxilab

View all CVEs affecting Image Hover Effects For Elementor With Lightbox And Flipbox →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could steal administrator credentials, deface websites, redirect users to malicious sites, or install backdoors for persistent access.

🟠

Likely Case

Attackers inject malicious scripts to steal user session cookies, perform actions as authenticated users, or display phishing content.

🟢

If Mitigated

With proper input validation and output escaping, the vulnerability is prevented, and only authorized users can modify plugin content.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated access but is straightforward once an attacker has Contributor privileges. The vulnerability is well-documented with specific parameter names identified.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Version 3.0.3 or later

Vendor Advisory: https://plugins.trac.wordpress.org/browser/image-hover-effects-with-carousel/

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Image Hover Effects for Elementor'. 4. Click 'Update Now' if available. 5. If no update appears, download version 3.0.3+ from WordPress.org and manually update.

🔧 Temporary Workarounds

Remove Contributor Access

all

Temporarily restrict Contributor-level user access until patching is complete.

Disable Vulnerable Plugin

linux

Deactivate the plugin if not essential for site functionality.

wp plugin deactivate image-hover-effects-with-carousel

🧯 If You Can't Patch

Implement strict user access controls and audit Contributor-level accounts
Deploy web application firewall (WAF) rules to block XSS payloads targeting the vulnerable parameters

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → Installed Plugins for 'Image Hover Effects for Elementor' version 3.0.2 or lower.

Check Version:

wp plugin get image-hover-effects-with-carousel --field=version

Verify Fix Applied:

Confirm plugin version is 3.0.3 or higher in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

Unusual POST requests to wp-admin containing '_id', 'oxi_addons_f_title_tag', or 'content_description_tag' parameters with script tags
Multiple failed login attempts followed by successful Contributor-level access

Network Indicators:

HTTP requests with JavaScript payloads in the vulnerable parameters
Unexpected outbound connections from WordPress site to external domains

SIEM Query:

source="wordpress.log" AND ("_id=" OR "oxi_addons_f_title_tag=" OR "content_description_tag=") AND ("<script>" OR "javascript:" OR "onerror=" OR "onload=")

📊 Metadata

CVE ID: CVE-2024-5001

CVSS v3 Score: 6.4 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

CWE: CWE-79

Published: June 6, 2024

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-5001, you might also want to check these: