CVE-2024-9657
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
Summary
The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tooltip' parameter in all versions up to, and including, 5.10.2. This vulnerability is due to insufficient input sanitization and output escaping. It affects authenticated attackers with Contributor-level access and above, allowing them to inject arbitrary web scripts in pages.
Impact
This vulnerability allows authenticated attackers with Contributor-level access or higher to inject malicious scripts into web pages. When users access these injected pages, the scripts will execute in their browsers. This can lead to various impacts such as: 1. Theft of sensitive information, including session cookies and other user data 2. Manipulation of page content, potentially misleading users or damaging the site's reputation 3. Performing unauthorized actions on behalf of the victim user 4. Redirecting users to malicious websites The vulnerability has a CVSS v3.1 base score of 5.4, indicating a medium severity level. The attack complexity is low, but it requires user interaction and some level of privileges.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. The vulnerability has been addressed in versions after 5.10.2 of the Element Pack Elementor Addons plugin for WordPress. The patch was added on 2024-11-08, as indicated by the patchAddedDate in the vulnerability data.
Mitigation
To mitigate this vulnerability, the following steps are recommended: 1. Update the Element Pack Elementor Addons plugin to a version newer than 5.10.2 as soon as possible. 2. If immediate updating is not possible, consider temporarily disabling the plugin or restricting access to it. 3. Implement strong user access controls to limit the number of users with Contributor-level access or higher. 4. Regularly audit and review user permissions to ensure they align with the principle of least privilege. 5. Implement Web Application Firewall (WAF) rules to detect and block XSS attempts. 6. Educate content contributors about the risks of XSS and proper input handling practices. 7. Regularly scan and monitor WordPress installations for any signs of compromise or unexpected behavior.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Timeline
NVD published the first details for CVE-2024-9657
A CVSS base score of 6.5 has been assigned.
Feedly found the first article mentioning CVE-2024-9657. See article
Feedly estimated the CVSS score as MEDIUM
EPSS Score was set to: 0.09% (Percentile: 37.5%)
A CVSS base score of 5.4 has been assigned.