CVE-2024-7144
📋 TL;DR
The JetElements WordPress plugin has a stored XSS vulnerability in all versions up to 2.6.20. Authenticated attackers with Contributor-level access or higher can inject malicious scripts that execute when users view compromised pages. This affects all WordPress sites using vulnerable versions of the JetElements plugin.
💻 Affected Systems
- JetElements for WordPress
📦 What is this software?
Jetelements by Crocoblock
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal admin credentials, redirect users to malicious sites, deface websites, or install backdoors for persistent access.
Likely Case
Attackers inject malicious scripts to steal user session cookies, redirect to phishing pages, or display unwanted content.
If Mitigated
With proper user role management and input validation, impact is limited to low-privilege content manipulation.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.6.21 or later
Vendor Advisory: https://crocoblock.com/plugins/jetelements/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find JetElements and click 'Update Now'. 4. Verify version is 2.6.21 or higher.
🔧 Temporary Workarounds
Temporary Plugin Deactivation
allDisable JetElements plugin until patched
wp plugin deactivate jetelements
Restrict User Roles
linuxTemporarily remove Contributor role access
wp user list --role=contributor --field=ID | xargs wp user set-role subscriber
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block XSS payloads
- Enable Content Security Policy (CSP) headers to restrict script execution
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → JetElements version numberCheck Version:
wp plugin get jetelements --field=versionVerify Fix Applied:
Verify JetElements version is 2.6.21 or higher in WordPress admin📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to JetElements endpoints with script tags in parameters
- Multiple failed authentication attempts followed by successful Contributor login
Network Indicators:
- HTTP requests containing <script> tags in 'id' or 'slide_id' parameters
- Outbound connections to suspicious domains after page loads
SIEM Query:
source="wordpress.log" AND ("jetelements" AND ("id=" OR "slide_id=") AND ("<script>" OR "javascript:"))