CVE-2024-5341
📋 TL;DR
The Plus Addons for Elementor plugin for WordPress has a stored XSS vulnerability in the Heading Title widget's 'size' attribute. Authenticated attackers with contributor-level access or higher can inject malicious scripts that execute when users view compromised pages. This affects all WordPress sites using the plugin up to version 5.5.4.
💻 Affected Systems
- The Plus Addons for Elementor Page Builder
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal admin credentials, redirect users to malicious sites, deface websites, or install backdoors for persistent access.
Likely Case
Attackers inject malicious scripts to steal user session cookies, redirect to phishing pages, or display unwanted content.
If Mitigated
With proper user role management and content review, impact is limited to potential defacement of specific pages.
🎯 Exploit Status
Exploitation requires authenticated access but is technically simple once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.5.5 or later
Vendor Advisory: https://roadmap.theplusaddons.com/updates/
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins > Installed Plugins
3. Find 'The Plus Addons for Elementor'
4. Click 'Update Now' if update is available
5. Alternatively, download version 5.5.5+ from WordPress repository
6. Deactivate, delete old version, upload and activate new version
🔧 Temporary Workarounds
Disable vulnerable widget
allTemporarily disable the Heading Title widget in Elementor settings
Restrict user roles
allRemove contributor-level editing permissions from untrusted users
🧯 If You Can't Patch
- Implement strict content review process for all contributor submissions
- Install a web application firewall (WAF) with XSS protection rules
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > The Plus Addons for Elementor. If version is 5.5.4 or lower, you are vulnerable.Check Version:
wp plugin list --name='The Plus Addons for Elementor' --field=versionVerify Fix Applied:
After updating, verify plugin version shows 5.5.5 or higher in WordPress plugins list.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /wp-admin/admin-ajax.php with 'size' parameter containing script tags
- Multiple page edits from contributor accounts
Network Indicators:
- Outbound connections to suspicious domains from your WordPress site
- Unexpected script loads in page responses
SIEM Query:
source="wordpress.log" AND ("size=" AND ("<script" OR "javascript:"))