Essential Addons for Elementor Vulnerability – Authenticated (Contributor+) Stored Cross-Site Scripting – CVE-2023-7044 | WordPress Plugin Vulnerability Report

Q: How do I know if my website is affected by this vulnerability in Essential Addons for Elementor?

How do I know if my website is affected by this vulnerability in Essential Addons for Elementor? You are affected if your site is running a version of Essential Addons for Elementor prior to 5.9.3. All releases up to and including 5.9.2 contain the authenticated stored cross-site scripting vulnerability that allows malicious code injection. To check your currently active version, log in to your WordPress dashboard and click on Plugins from the left menu. Check the version listed next to Essential Addons for Elementor on the Plugins page.

Q: I updated the plugin but am not technical - how can I check if my site was compromised?

I updated the plugin but am not technical - how can I check if my site was compromised? Since this vulnerability permits JavaScript injection, review any customized Elementor templates and themes for unauthorized or suspicious code blocks. Look for snippets that seem out of place or serve no clear purpose. If discovered, remove immediately. Running a security plugin can also automatically detect suspected malicious code. If still concerned, enlist an expert for a comprehensive website audit to determine conclusively whether your site was compromised and address any issues discovered.

Q: Is updating the only way to protect my website against this stored XSS attack in Essential Addons?

Is updating the only way to protect my website against this stored XSS attack in Essential Addons? While upgrading to the latest patched release should be priority one, additional steps can further secure your site. Review permission levels to ensure editing access is truly restricted only to trusted users that need it. Limit the number of accounts assigned a Contributor role or higher to reduce exposure. Also be cautious of plugin or theme authors seeking excessive permissions during setup. Enable 2-factor authentication wherever possible for all Administrator accounts.

Q: How serious is this vulnerability? My site has not been impacted noticeably.

How serious is this vulnerability? My site has not been impacted noticeably. The public nature, ease of exploit for authorized users, and lack of visibility around actual attacks makes CVE-2023-7044 a serious concern. Even if your site operations seem unaffected so far, it may have served as an access point. Outdated plugin installations give attackers openings to explore other weak points that can lead to compromise days or weeks later. Timely patching is critical, even when vulnerability impacts are not immediately clear.

Q: Should I switch from Essential Addons and move to another page builder plugin after this?

Should I switch from Essential Addons and move to another page builder plugin after this? The developers addressed this flaw quickly by releasing version 5.9.3, demonstrating their commitment to user security. While other plugins like Beaver Builder are alternatives, there is no perfect solution. Vulnerabilities can happen despite best efforts. Staying current with updates for whatever solutions you rely on is the best defense. If still uncomfortable, consult experts on considerations before migrating critical site functionality to new plugins.

Q: What is stored cross-site scripting (XSS) and why is it dangerous?

What is stored cross-site scripting (XSS) and why is it dangerous? Stored XSS involves injecting malicious JavaScript into a website where it gets saved and later served to visitors. This differs from other cross-site scripting exploits in that the harmful code persists instead of just showing once. Attackers can use stored XSS to steal session data, extract sensitive site or customer information, spread malware, and deface content. Depending on where injected, the scripts may bypass common protective filters and checks as well.

Q: Could updating themes prevent this stored XSS vulnerability in the plugin?

Could updating themes prevent this stored XSS vulnerability in the plugin? No, updating WordPress themes does not resolve this issue in Essential Addons for Elementor specifically. The vulnerability stems from insufficient input sanitization before saving Elementor templates that include custom identifiers. Only updating the plugin to version 5.9.3 or newer truly mitigates the authenticated JavaScript injection and storage weaknesses to prevent exploitation.

Q: Does deactivating Essential Addons for Elementor eliminate the XSS vulnerability if I cannot update immediately?

Does deactivating Essential Addons for Elementor eliminate the XSS vulnerability if I cannot update immediately? Temporarily deactivating the plugin removes the capacity for malicious script injection through this specific vector. However, it likely heavily impacts your site's appearance and function since many sites rely on Essential Addons. Deactivation also does nothing to remove scripts already injected through this vulnerability on vulnerable versions. Properly patching by upgrading to the latest fixed release is the only comprehensive solution.

Q: I use an outdated PHP version. Can I still update Essential Addons to address this?

I use an outdated PHP version. Can I still update Essential Addons to address this? If your host restricts PHP updates, this makes patching tricky. While Essential Addons v5.9.3 supports PHP 5.6 and newer, plugin developers aim to fully transition to PHP 8 soon. Talk to your host about PHP upgrade options or seek plans allowing modern releases. Running outdated stacks like PHP 5.5 not only prevents crucial security fixes but also exposes sites to additional issues from lack of language improvements. Staying current with software updates feels never-ending but is crucial for security. Check plugins like Essential Addons for Elementor regularly for fixes to avoid new attack avenues from emerging vulnerabilities. Prioritize patches that resolve urgent flaws like authenticated stored XSS to best defend your website.

By Your WP Guy | January 3, 2024

Plugin Name: Essential al Addons for Elementor

Key Information:

Software Type: Plugin
Software Slug: essential-addons-for-elementor-lite
Software Status: Active
Software Author: wpdevteam
Software Downloads: 62,990,243
Active Installs: 1,000,000
Last Updated: January 3, 2024
Patched Versions: 5.9.3
Affected Versions: <= 5.9.2

Vulnerability Details:

Name: Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Title: Authenticated (Contributor+) Stored Cross-Site Scripting
Type: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE: CVE-2023-7044
CVSS Score: 6.4 (Medium)
Publicly Published: January 3, 2024
Researcher: Webbernaut
Description: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom ID in all versions up to, and including, 5.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor access and higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Summary:

The Essential Addons for Elementor plugin for WordPress has a vulnerability in versions up to and including 5.9.2 that allows authenticated users with contributor access or higher to inject malicious JavaScript that will execute when pages are loaded. This vulnerability has been patched in version 5.9.3.

Detailed Overview:

A vulnerability classified as Stored Cross-Site Scripting was discovered in the Essential Addons for Elementor plugin by researcher Webbernaut. This vulnerability allows authenticated users with contributor access or higher to inject arbitrary JavaScript payloads into Elementor templates via a custom ID parameter. The payloads are then stored and will execute whenever a user accesses an injected page. This could allow malicious users to steal session cookies or sensitive information. While the access requirements limit the exploitation vector, it still poses a risk to users. Developers have addressed the insufficient input sanitization and output escaping issues in version 5.9.3. All users are urged to update immediately.

Advice for Users:

Immediate Action: Update to version 5.9.3 or later as soon possible.
Check for Signs of Vulnerability: Review page templates for unauthorized JavaScript.
Alternate Plugins: Consider alternate page builder plugins like Beaver Builder if concerned.
Stay Updated: Always keep plugins updated to avoid vulnerable versions.

Conclusion:

The response by wpdevteam to address this vulnerability reinforces the need to promptly install security updates. Users should upgrade to version 5.9.3 to mitigate any potential attacks leveraging this issue on their WordPress sites.

References:

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/essential-addons-for-elementor-lite

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/essential-addons-for-elementor-lite/essential-addons-for-elementor-best-elementor-templates-widgets-kits-woocommerce-builders-592-authenticated-contributor-stored-cross-site-scripting

Detailed Report:

Keeping your WordPress website secure should be a priority for any business relying on an online presence, but staying on top of vulnerabilities can feel impossible. Unfortunately, popular page builder plugin Essential Addons for Elementor was recently revealed to have a stored cross-site scripting flaw that puts outdated installations at serious risk. Don’t let your hard work be compromised by outdated software. By taking a few proactive security measures, you can protect your business website despite having minimal time for website administration.

The Vulnerability Explained

Researcher Webbernaut disclosed the vulnerability tracked as CVE-2023-7044 affecting Essential Addons for Elementor versions up to and including 5.9.2 in early January 2024. The plugin is actively installed on over 1 million WordPress sites.

The vulnerability allows authenticated users with contributor access or higher privileges to inject arbitrary JavaScript code into page templates and themes within the Elementor editor. This malicious code then gets stored and executed whenever a vulnerable page is visited by any user.

Impacts to Businesses

This vulnerability means an authorized user could leverage their access to compromise business sites relying on older versions of Essential Addons for Elementor. Attackers could steal session cookies, hijack admin accounts, extract sensitive customer or business data, or insert unwanted content.

While the vulnerability was addressed promptly in version 5.9.3, many businesses have not yet updated. Every day without patching exposes WordPress sites to potential compromise through this specific flaw.

Remediating the Vulnerability

Update Essential Addons for Elementor to version 5.9.3 or newer. This patches the vulnerability at its core by addressing the underlying code flaws.
Scan page templates and themes for unauthorized code. Watch for malicious JavaScript that may have been injected already. Remove anything suspicious.
Limit contributor accounts only to those that need them. Reduce exposure by ensuring editing access is restricted properly across your website.

Staying on top of vulnerabilities like this can be challenging, but with a layered approach you can secure your website despite limited time. Set calendar reminders to periodically check plugins and themes for updates. Enlist support to receive notifications whenever vulnerabilities in key software are disclosed. Prioritize upgrades that fix security flaws.

While the Internet introduces growing threats, don’t let them stop your business success. Take the steps to shift website security from an afterthought to a priority. Protect your hard work by proactively securing your online presence against compromise through vulnerabilities like this.

Don't tackle WordPress security alone - the consequences of a breach are too great. At Your WP Guy, our managed WordPress maintenance services include layers of protection like auto-updates, malware scanning, firewalls and 24/7 monitoring by WordPress experts. We become your outsourced IT team.

Let's chat about migrating your site to our managed hosting so you can finally stop worrying about security issues. We'll fully audit and lock down your site as part of onboarding. Call us at 678-995-5169 to keep your business safe online.

Essential Addons for Elementor Vulnerability – Authenticated (Contributor+) Stored Cross-Site Scripting – CVE-2023-7044 | WordPress Plugin Vulnerability Report FAQs

How do I know if my website is affected by this vulnerability in Essential Addons for Elementor?

You are affected if your site is running a version of Essential Addons for Elementor prior to 5.9.3. All releases up to and including 5.9.2 contain the authenticated stored cross-site scripting vulnerability that allows malicious code injection. To check your currently active version, log in to your WordPress dashboard and click on Plugins from the left menu. Check the version listed next to Essential Addons for Elementor on the Plugins page.

I updated the plugin but am not technical - how can I check if my site was compromised?

Since this vulnerability permits JavaScript injection, review any customized Elementor templates and themes for unauthorized or suspicious code blocks. Look for snippets that seem out of place or serve no clear purpose. If discovered, remove immediately. Running a security plugin can also automatically detect suspected malicious code. If still concerned, enlist an expert for a comprehensive website audit to determine conclusively whether your site was compromised and address any issues discovered.

Is updating the only way to protect my website against this stored XSS attack in Essential Addons?

While upgrading to the latest patched release should be priority one, additional steps can further secure your site. Review permission levels to ensure editing access is truly restricted only to trusted users that need it. Limit the number of accounts assigned a Contributor role or higher to reduce exposure. Also be cautious of plugin or theme authors seeking excessive permissions during setup. Enable 2-factor authentication wherever possible for all Administrator accounts.

How serious is this vulnerability? My site has not been impacted noticeably.

The public nature, ease of exploit for authorized users, and lack of visibility around actual attacks makes CVE-2023-7044 a serious concern. Even if your site operations seem unaffected so far, it may have served as an access point. Outdated plugin installations give attackers openings to explore other weak points that can lead to compromise days or weeks later. Timely patching is critical, even when vulnerability impacts are not immediately clear.

Should I switch from Essential Addons and move to another page builder plugin after this?

The developers addressed this flaw quickly by releasing version 5.9.3, demonstrating their commitment to user security. While other plugins like Beaver Builder are alternatives, there is no perfect solution. Vulnerabilities can happen despite best efforts. Staying current with updates for whatever solutions you rely on is the best defense. If still uncomfortable, consult experts on considerations before migrating critical site functionality to new plugins.

What is stored cross-site scripting (XSS) and why is it dangerous?

Stored XSS involves injecting malicious JavaScript into a website where it gets saved and later served to visitors. This differs from other cross-site scripting exploits in that the harmful code persists instead of just showing once. Attackers can use stored XSS to steal session data, extract sensitive site or customer information, spread malware, and deface content. Depending on where injected, the scripts may bypass common protective filters and checks as well.

Could updating themes prevent this stored XSS vulnerability in the plugin?

No, updating WordPress themes does not resolve this issue in Essential Addons for Elementor specifically. The vulnerability stems from insufficient input sanitization before saving Elementor templates that include custom identifiers. Only updating the plugin to version 5.9.3 or newer truly mitigates the authenticated JavaScript injection and storage weaknesses to prevent exploitation.

Does deactivating Essential Addons for Elementor eliminate the XSS vulnerability if I cannot update immediately?

Temporarily deactivating the plugin removes the capacity for malicious script injection through this specific vector. However, it likely heavily impacts your site's appearance and function since many sites rely on Essential Addons. Deactivation also does nothing to remove scripts already injected through this vulnerability on vulnerable versions. Properly patching by upgrading to the latest fixed release is the only comprehensive solution.

I use an outdated PHP version. Can I still update Essential Addons to address this?

If your host restricts PHP updates, this makes patching tricky. While Essential Addons v5.9.3 supports PHP 5.6 and newer, plugin developers aim to fully transition to PHP 8 soon. Talk to your host about PHP upgrade options or seek plans allowing modern releases. Running outdated stacks like PHP 5.5 not only prevents crucial security fixes but also exposes sites to additional issues from lack of language improvements.

Staying current with software updates feels never-ending but is crucial for security. Check plugins like Essential Addons for Elementor regularly for fixes to avoid new attack avenues from emerging vulnerabilities. Prioritize patches that resolve urgent flaws like authenticated stored XSS to best defend your website.

Share this post:

X (Twitter) Facebook Pinterest LinkedIn Email Reddit WhatsApp Pocket SMS

Posted in Security, Vulnerabilities and tagged CVE-2023-7044, elementor security, Essential Addons for Elementor, Plugin Updates, security vulnerability, Stored Cross-Site Scripting, Web Security, Website Security, wordpress security, XSS vulnerability

Essential Addons for Elementor Vulnerability – Authenticated (Contributor+) Stored Cross-Site Scripting – CVE-2023-7044 | WordPress Plugin Vulnerability Report

Plugin Name: Essential al Addons for Elementor

Key Information:

Vulnerability Details:

Summary:

Detailed Overview:

Advice for Users:

Conclusion:

References:

Detailed Report:

The Vulnerability Explained

Impacts to Businesses

Remediating the Vulnerability

Essential Addons for Elementor Vulnerability – Authenticated (Contributor+) Stored Cross-Site Scripting – CVE-2023-7044 | WordPress Plugin Vulnerability Report FAQs

How do I know if my website is affected by this vulnerability in Essential Addons for Elementor?

How do I know if my website is affected by this vulnerability in Essential Addons for Elementor?

I updated the plugin but am not technical - how can I check if my site was compromised?

I updated the plugin but am not technical - how can I check if my site was compromised?

Is updating the only way to protect my website against this stored XSS attack in Essential Addons?

Is updating the only way to protect my website against this stored XSS attack in Essential Addons?

How serious is this vulnerability? My site has not been impacted noticeably.

How serious is this vulnerability? My site has not been impacted noticeably.

Should I switch from Essential Addons and move to another page builder plugin after this?

Should I switch from Essential Addons and move to another page builder plugin after this?

What is stored cross-site scripting (XSS) and why is it dangerous?

What is stored cross-site scripting (XSS) and why is it dangerous?

Could updating themes prevent this stored XSS vulnerability in the plugin?

Could updating themes prevent this stored XSS vulnerability in the plugin?

Does deactivating Essential Addons for Elementor eliminate the XSS vulnerability if I cannot update immediately?

Does deactivating Essential Addons for Elementor eliminate the XSS vulnerability if I cannot update immediately?

I use an outdated PHP version. Can I still update Essential Addons to address this?

I use an outdated PHP version. Can I still update Essential Addons to address this?

Share this post:

Leave a Comment Cancel Reply

Recent Blog Posts

LiteSpeed Cache Vulnerability – Unauthenticated Sensitive Information Exposure via Log Files – CVE-2024-44000 | WordPress Plugin Vulnerability Report

Elementor Addon Elements Vulnerability – Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Parameters – CVE-2024-4401, CVE-2024-7122 | WordPress Plugin Vulnerability Report

The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid Vulnerability – Authenticated (Contributor+) Information Disclosure – CVE-2024-7418 | WordPress Plugin Vulnerability Report

Additional Resources

About Your WP Guy