Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) Vulnerability – Authenticated Stored Cross-Site Scripting – CVE-2024-1428 & CVE-2024-0837 | WordPress Plugin Vulnerability Report

Q: What should I do if my plugin is already at version 5.5.4?

What should I do if my plugin is already at version 5.5.4? If your plugin is already at version 5.5.4, you are protected from the vulnerabilities discussed in CVE-2024-1428 and CVE-2024-0837. However, it is still important to stay vigilant. Regularly update all your plugins, themes, and the WordPress core to protect against future vulnerabilities.

Q: How often should I update my WordPress plugins?

How often should I update my WordPress plugins? It's best to update your WordPress plugins as soon as updates are available. Developers frequently release updates to fix bugs, add features, and patch security vulnerabilities. Keeping your plugins updated is a key part of maintaining your website's security and functionality.

Q: Can I set my plugins to update automatically?

Can I set my plugins to update automatically? Yes, WordPress allows you to enable automatic updates for plugins. You can configure this setting within your WordPress dashboard under the Plugins section. Enabling automatic updates is a practical way to ensure you are always running the most secure and stable versions of your plugins.

By Your WP Guy | April 5, 2024

Plugin Name: Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows)

Key Information:

Software Type: Plugin
Software Slug: bdthemes-element-pack-lite
Software Status: Active
Software Author: bdthemes
Software Downloads: 1,990,743
Active Installs: 100,000
Last Updated: April 15, 2024
Patched Versions: 5.5.4
Affected Versions: <= 5.5.3

Vulnerability Details:

Name: Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.5.3
- Title: Authenticated (Contributor+) Stored Cross-Site Scripting via Trailer Box Widget
- Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- CVE: CVE-2024-1428
- CVSS Score: 6.4
- Publicly Published: April 5, 2024
- Researcher: Nikolas - mdr
- Description: The plugin is vulnerable to Stored Cross-Site Scripting via the ‘element_pack_wrapper_link’ attribute of the Trailer Box widget in all versions up to, and including, 5.5.3 due to insufficient input sanitization and output escaping. This allows authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Name: Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.3.2
- Title: Authenticated (Contributor+) Stored Cross-Site Scripting via 'Custom Gallery' Widget
- Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- CVE: CVE-2024-0837
- CVSS Score: 6.4
- Publicly Published: April 5, 2024
- Researcher: Webbernaut
- Description: The plugin is vulnerable to Stored Cross-Site Scripting via the image URL parameter in the 'Custom Gallery' Widget in all versions up to, and including, 5.3.2 due to insufficient input sanitization and output escaping. This enables authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Summary:

The Element Pack Elementor Addons plugin for WordPress has vulnerabilities in versions up to and including 5.5.3 that expose it to stored cross-site scripting issues. These vulnerabilities have been patched in version 5.5.4.

Detailed Overview:

The identified vulnerabilities within the Element Pack Elementor Addons plugin highlight significant risks, particularly the possibility for script injection through various widgets. These vulnerabilities are exploitable by users with at least contributor-level access, which means they could potentially affect numerous sites. The risks associated with these vulnerabilities include unauthorized access to user data, site defacement, and further attacks that could compromise the security of site visitors.

Advice for Users:

Immediate Action: Update to version 5.5.4 without delay.
Check for Signs of Vulnerability: Regularly monitor your site for unusual activities or unauthorized changes to content.
Alternate Plugins: Consider using alternative plugins that offer similar functionality, especially if updates cannot be applied promptly.
Stay Updated: Regularly updating your plugins and WordPress core is crucial for maintaining site security.

Conclusion:

The swift action taken by the plugin developers to release a patch for these vulnerabilities reflects the importance of maintaining current versions of all software components of your website. To ensure the safety and integrity of your WordPress installation, always ensure you are running patched versions, in this case, version 5.5.4 or later.

References:

Detailed Report:

Introduction

In today’s digital ecosystem, keeping your WordPress site up to date is not just beneficial—it's essential for security. Recently, critical vulnerabilities identified in the Element Pack Elementor Addons plugin, a popular tool utilized by over 100,000 websites for adding dynamic content like headers, footers, and carousels, underscore the risks of outdated software. Identified as CVE-2024-1428 and CVE-2024-0837, these vulnerabilities allow for stored cross-site scripting attacks that could compromise both user data and website integrity.

Vulnerability Overview

The vulnerabilities in question allow authenticated users, with contributor-level access and above, to inject arbitrary web scripts into pages:

CVE-2024-1428: Through the ‘element_pack_wrapper_link’ attribute of the Trailer Box widget.
CVE-2024-0837: Via the image URL parameter in the 'Custom Gallery' Widget.

These issues were present up to version 5.5.3 and were publicly disclosed on April 5, 2024, by researchers Nikolas - mdr and Webbernaut.

Risks and Potential Impacts

The vulnerabilities present significant security risks, particularly the ability for malicious scripts to be stored and executed, potentially leading to unauthorized access to user data, site defacement, or the delivery of malware to users. The broad functionalities affected by these vulnerabilities make the plugin a prime target, which could lead to widespread compromise if not addressed.

Remediation Steps

Immediate Action: Update your plugin to version 5.5.4 through your WordPress dashboard under Plugins > Installed Plugins.
Verify Security: Regularly check your site for signs of compromise, such as unexpected changes or user complaints.
Professional Consultation: Consider engaging a cybersecurity professional to conduct a thorough review if you suspect your site has been compromised.

Previous Vulnerabilities

Since its release, the Element Pack Elementor Addons plugin has had a history of security issues, with three vulnerabilities reported since February 2024. This history highlights the necessity of regular updates and vigilance.

Conclusion

For small business owners, the task of maintaining a website can be daunting, particularly with the constant need for security updates. However, the potential costs of neglecting these updates—ranging from data breaches to complete site recovery—can far outweigh the effort required to keep software up to date. By adopting proactive security measures, such as regular updates and monitoring, small business owners can significantly reduce their vulnerability to cyber threats.

The recent patch released by the developers of the Element Pack Elementor Addons plugin at version 5.5.4 addresses the latest vulnerabilities and serves as a critical reminder of the importance of maintaining current versions of all software components of your website. Ensure your business and its digital assets are protected by staying informed and proactive about website security.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) Vulnerability – Authenticated Stored Cross-Site Scripting – CVE-2024-1428 & CVE-2024-0837 | WordPress Plugin Vulnerability Report FAQs

What exactly is cross-site scripting, and why is it dangerous?

Cross-site scripting, often abbreviated as XSS, is a type of security vulnerability typically found in web applications. This vulnerability allows attackers to inject client-side scripts into web pages viewed by other users. A successful XSS attack can result in attackers gaining access to user accounts, defacing websites, or redirecting visitors to malicious sites, thereby compromising confidentiality, integrity, and availability of the affected site.

How can I tell if my version of the Element Pack Elementor Addons plugin is vulnerable?

To check your plugin version, log in to your WordPress dashboard and navigate to the 'Plugins' section. Look for the Element Pack Elementor Addons plugin in your list of installed plugins and check the version number listed. If it is version 5.5.3 or lower, your plugin is vulnerable and needs to be updated to version 5.5.4 immediately.

What should I do if my plugin is already at version 5.5.4?

Are there any specific settings or configurations I should check within the plugin?

While the recent updates have patched the security vulnerabilities, it's a good practice to review your plugin settings. Ensure that only users with the necessary permissions have access to critical functionalities. Limiting user permissions can be an effective way to mitigate potential damages from future exploits.

How often should I update my WordPress plugins?

What are the risks of not updating a plugin with known vulnerabilities?

Failing to update a plugin with known vulnerabilities significantly increases the risk of your website being exploited by attackers. Such exploits can lead to unauthorized access, data breaches, insertion of malicious content, and even complete site takeover. Updating your plugins promptly helps prevent these risks and keeps your site secure.

Can I set my plugins to update automatically?

What should I do if I suspect my website has been compromised?

If you suspect that your website has been compromised, act immediately. First, assess and remove any unauthorized changes or content. Next, update all plugins, themes, and the WordPress core. Consider consulting a cybersecurity professional to understand the depth of the breach and for help with recovery. Finally, inform your users if their data might have been affected.

How can I enhance overall security for my WordPress site?

To enhance the security of your WordPress site, start by keeping all software up to date. Implement strong passwords and consider using two-factor authentication for an added layer of security. Regularly back up your site and consider using a web application firewall. These measures can significantly improve your site's resilience against attacks.

What are the best practices for managing user roles on WordPress?

Best practices for managing user roles include granting users the least privileges necessary to perform their tasks. Regularly review and adjust permissions as needed, especially when users change roles or leave your organization. Plugins that manage or extend user roles can offer more granular control over what users can and cannot do on your site.

Share this post:

X (Twitter) Facebook Pinterest LinkedIn Email Reddit WhatsApp Pocket SMS

Posted in Security, Vulnerabilities and tagged CVE-2024-0837, CVE-2024-1428, Cybersecurity, Element Pack Elementor Addons, plugin vulnerabilities, Small Business Security, software updates, Website Protection, WordPress Plugin Safety, wordpress security