Essential Addons for Elementor Vulnerability- Authenticated Stored Cross-Site Scripting via Data Table – CVE-2024-1537 |WordPress Plugin Vulnerability Report

Plugin Name: Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders

Key Information:

  • Software Type: Plugin
  • Software Slug: essential-addons-for-elementor-lite
  • Software Status: Active
  • Software Author: wpdevteam
  • Software Downloads: 67,142,962
  • Active Installs: 2,000,000
  • Last Updated: March 13, 2024
  • Patched Versions: 5.9.10
  • Affected Versions: <= 5.9.9

Vulnerability Details:

  • Name: Essential Addons for Elementor <= 5.9.9
  • Title: Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2024-1537
  • CVSS Score: 6.4
  • Publicly Published: March 11, 2024
  • Researcher: Wesley
  • Description: The plugin is vulnerable to Stored Cross-Site Scripting (XSS) through its Data Table widget due to inadequate input sanitization and output escaping. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when another user views the affected page.

Summary:

The widely-used Essential Addons for Elementor plugin has been found vulnerable in versions up to 5.9.9, allowing for Stored Cross-Site Scripting attacks through the Data Table widget. This vulnerability, identified as CVE-2024-1537, endangers website integrity and user safety but has been rectified in version 5.9.10.

Detailed Overview:

Discovered by security researcher Wesley, CVE-2024-1537 highlights the critical need for stringent input sanitization in web applications, particularly those providing user input functionalities. The exploitability of this vulnerability by authenticated users underscores the importance of role-based access controls and robust security measures in plugin development.

Advice for Users:

  • Immediate Action: Update the Essential Addons for Elementor plugin to version 5.9.10 immediately to mitigate the risk posed by CVE-2024-1537.
  • Check for Signs of Vulnerability: Regularly audit your site for unexpected content changes or functionalities, which may indicate the exploitation of this vulnerability.
  • Alternate Plugins: While the patched version is secure, exploring alternative Elementor addons may provide additional security or functionality benefits.
  • Stay Updated: Ensure all WordPress components, including plugins, themes, and core installations, are up-to-date to protect against known vulnerabilities.

Conclusion:

The timely resolution of CVE-2024-1537 within Essential Addons for Elementor reaffirms the ongoing importance of cybersecurity vigilance in the WordPress community. For website administrators, particularly those overseeing sites for small businesses, the proactive management of software updates is vital in safeguarding digital assets against evolving threats.

References:

In the ever-evolving digital landscape, the security of WordPress plugins remains a paramount concern, especially for widely-used plugins that enhance site functionality. A recent security vulnerability identified in the Essential Addons for Elementor plugin underscores the necessity of regular updates and diligent cybersecurity practices. With over 67 million downloads and active installations on 2 million sites, the potential impact of this vulnerability is extensive, affecting versions up to 5.9.9.

About the Plugin:

Essential Addons for Elementor is a popular plugin that expands the capabilities of the Elementor page builder, offering additional widgets and features for WordPress websites. Developed by wpdevteam, this plugin has become a staple for many website owners seeking to enhance their site's design and functionality.

Vulnerability Details:

The vulnerability, CVE-2024-1537, was discovered by security researcher Wesley and publicly reported on March 11, 2024. It involves a Stored Cross-Site Scripting (XSS) issue within the Data Table widget of the plugin, where insufficient input sanitization and output escaping allow authenticated users with contributor-level access or higher to inject malicious scripts. These scripts could then be executed by other users, compromising site integrity and user data.

Risks and Impacts:

Stored XSS vulnerabilities like this one pose significant risks, including unauthorized access to sensitive information, website defacement, and the potential distribution of malware to unsuspecting site visitors. Given the plugin's extensive user base, the implications of such a vulnerability cannot be understated.

Remediation:

To address this vulnerability, the plugin's developers released version 5.9.10, which implements necessary security measures to prevent such attacks. Users of the Essential Addons for Elementor plugin are strongly advised to update to this latest version to safeguard their sites.

Previous Vulnerabilities:

This is not the first vulnerability reported for the Essential Addons for Elementor plugin; there have been 17 previous instances since April 13, 2021. This history emphasizes the importance of ongoing vigilance and regular updates to maintain security.

Conclusion:

The discovery and prompt resolution of CVE-2024-1537 serve as a crucial reminder of the importance of cybersecurity in maintaining a secure and trustworthy online presence. For small business owners and WordPress site administrators, staying informed about vulnerabilities and applying timely updates are indispensable practices. In a digital environment where threats continuously evolve, proactive security measures are the key to safeguarding your website and its users.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Essential Addons for Elementor Vulnerability- Authenticated Stored Cross-Site Scripting via Data Table – CVE-2024-1537 |WordPress Plugin Vulnerability Report FAQs

Leave a Comment