CVE-2024-8515 – The Themesflat Addons For Elementor WordPress p... (How to Fix)

Q: What is the severity of CVE-2024-8515?

CVE-2024-8515 has a CVSS score of 6.4 (MEDIUM). The Themesflat Addons For Elementor WordPress plugin has a stored XSS vulnerability that allows authenticated attackers with Contributor access or higher to inject malicious scripts into web pages. These scripts execute when users visit the compromised pages, potentially stealing credentials or performing unauthorized actions. All WordPress sites using this plugin version 2.2.1 or earlier are affected.

📋 TL;DR

The Themesflat Addons For Elementor WordPress plugin has a stored XSS vulnerability that allows authenticated attackers with Contributor access or higher to inject malicious scripts into web pages. These scripts execute when users visit the compromised pages, potentially stealing credentials or performing unauthorized actions. All WordPress sites using this plugin version 2.2.1 or earlier are affected.

💻 Affected Systems

Products:

Themesflat Addons For Elementor WordPress plugin

Versions: All versions up to and including 2.2.1

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WordPress with Elementor and the vulnerable plugin installed. Contributor-level access or higher needed for exploitation.

📦 What is this software?

Themesflat Addons For Elementor by Themesflat

View all CVEs affecting Themesflat Addons For Elementor →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could steal administrator credentials, deface websites, redirect users to malicious sites, or install backdoors for persistent access.

🟠

Likely Case

Attackers with contributor accounts inject malicious scripts to steal user session cookies or credentials, potentially escalating privileges.

🟢

If Mitigated

With proper input validation and output escaping, malicious scripts are neutralized before execution, preventing exploitation.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated access but is straightforward due to insufficient input sanitization in multiple widgets.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Version 2.2.2 or later

Vendor Advisory: https://wordpress.org/plugins/themesflat-addons-for-elementor/#developers

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Themesflat Addons For Elementor'. 4. Click 'Update Now' if available. 5. Alternatively, download latest version from WordPress repository and replace plugin files.

🔧 Temporary Workarounds

Disable vulnerable widgets

all

Temporarily disable affected widgets (TF E Slider, TF Video, TF Team, etc.) via Elementor settings to prevent exploitation.

Restrict user roles

all

Limit Contributor and higher role assignments to trusted users only until patching.

🧯 If You Can't Patch

Remove or disable the Themesflat Addons For Elementor plugin entirely
Implement strict Content Security Policy (CSP) headers to mitigate script execution

🔍 How to Verify

Check if Vulnerable:

Check plugin version in WordPress admin under Plugins > Installed Plugins. If version is 2.2.1 or earlier, you are vulnerable.

Check Version:

wp plugin list --name=themesflat-addons-for-elementor --field=version

Verify Fix Applied:

After updating, verify plugin version shows 2.2.2 or later. Test affected widgets with malicious input to ensure sanitization.

📡 Detection & Monitoring

Log Indicators:

Unusual POST requests to widget update endpoints
Suspicious JavaScript in page content or URL parameters

Network Indicators:

Unexpected script tags in HTTP responses from affected pages

SIEM Query:

source="wordpress" AND (uri_path="/wp-admin/admin-ajax.php" OR uri_path CONTAINS "elementor") AND (http_method="POST" AND (param_name CONTAINS "url" OR param_name CONTAINS "link"))

📊 Metadata

CVE ID: CVE-2024-8515

CVSS v3 Score: 6.4 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

CWE: CWE-79

Published: September 25, 2024

Last Updated: October 2, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-8515, you might also want to check these: