[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$flr2bMlDTytRtR-4caxth-1qicDM1TXOHfmrb2Vmby_A":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-57376","elementinvader-addons-for-elementor-unauthenticated-stored-cross-site-scripting","ElementInvader Addons for Elementor \u003C= 1.4.3 - Unauthenticated Stored Cross-Site Scripting","The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","elementinvader-addons-for-elementor",null,"\u003C=1.4.3","1.4.4","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-07 00:00:00","2026-07-14 19:50:22",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fb9790543-f4db-46a7-ad0d-3276dcf3a64a?source=api-prod",8,[22,23,24,25,26,27,28,29],"README.txt","assets\u002Fcss\u002Fmain.css","assets\u002Fcss\u002Fwidgets\u002Fblog-search.css","assets\u002Fcss\u002Fwidgets\u002Fcontact_form.css","assets\u002Fcss\u002Fwidgets\u002Fmap.css","assets\u002Fcss\u002Fwidgets\u002Fmenu.css","assets\u002Fjs\u002Feli-modal.js","assets\u002Fjs\u002Fmain.js","researched",false,3,"This research plan focuses on exploiting a Stored Cross-Site Scripting (XSS) vulnerability in the **ElementInvader Addons for Elementor** plugin.\n\n### 1. Vulnerability Summary\nThe **ElementInvader Addons for Elementor** plugin (up to version 1.4.3) fails to sanitize and escape user-provided input in its form submission features (Contact Form and Newsletter). Specifically, unauthenticated users can submit data containing malicious JavaScript through the plugin's AJAX handlers. This data is stored in the WordPress database and subsequently executed in the browser of an administrative user when they view the submissions or \"maillist\" in the WordPress backend.\n\n### 2. Attack Vector Analysis\n*   **Endpoint:** `wp-admin\u002Fadmin-ajax.php`\n*   **AJAX Action:** `elementinvader_addons_for_elementor_forms_send_form` (identified from `assets\u002Fjs\u002Fmain.js`)\n*   **Vulnerable Parameters:** Any form field serialized and sent to the handler, typically `name`, `email`, `message`, or custom field inputs.\n*   **Authentication:** None (Unauthenticated). The handler is registered via `wp_ajax_nopriv_`.\n*   **Preconditions:**\n    1.  The \"Simple Contact Form\" or \"Simple Newsletter\" widget must be present on a public-facing page or post.\n    2.  An administrator must eventually view the stored submissions in the WordPress dashboard.\n\n### 3. Code Flow\n1.  **Entry Point:** The plugin registers an AJAX handler for unauthenticated users in PHP (inferred):\n    `add_action('wp_ajax_nopriv_elementinvader_addons_for_elementor_forms_send_form', '...');`\n2.  **Frontend Capture:** In `assets\u002Fjs\u002Fmain.js`, the plugin attaches a submit listener to forms with the class `.elementinvader_addons_for_elementor_f`.\n3.  **Data Transmission:** The JS gathers all form inputs via `this_form.serializeArray()`, appends the action `elementinvader_addons_for_elementor_forms_send_form`, and sends a POST request to the URL stored in the `.config` element's `data-url` attribute (usually `admin-ajax.php`).\n4.  **Backend Processing (Sink):** The PHP handler receives the raw POST data and saves it to the database (likely a custom table or as a `post_type`) without using `sanitize_text_field()` or `wp_kses()`.\n5.  **Rendering (Execution):** When an admin accesses the \"Submissions\" or \"Newsletter\" list in the WP-Admin, the plugin fetches the raw data and echoes it directly into the HTML table\u002Fview without using `esc_html()` or `esc_attr()`.\n\n### 4. Nonce Acquisition Strategy\nAccording to the `README.txt` (version 1.4.0), the plugin added \"Form Poc Protect with Token\". This suggests a nonce or token is required for the AJAX request.\n\n1.  **Identify Widget Location:** Scan the site for a page containing the class `elementinvader_contact_form` or `elementinvader_newsletter`.\n2.  **Navigate to Page:** Use the `browser_navigate` tool to open the page.\n3.  **Extract Token:** The token is likely a hidden input field within the form, as `main.js` uses `serializeArray()`. Use `browser_eval` to extract it:\n    ```javascript\n    \u002F\u002F Look for common nonce\u002Ftoken field names used by this plugin\n    browser_eval(`\n        document.querySelector('form.elementinvader_addons_for_elementor_f input[name=\"_wpnonce\"]')?.value || \n        document.querySelector('form.elementinvader_addons_for_elementor_f input[name=\"nonce\"]')?.value ||\n        document.querySelector('form.elementinvader_addons_for_elementor_f input[name=\"token\"]')?.value\n    `)\n    ```\n4.  **AJAX URL:** Extract the AJAX URL from the widget's config:\n    ```javascript\n    browser_eval(`document.querySelector('.elementinvader_addons_for_elementor_f .config').getAttribute('data-url')`)\n    ```\n\n### 5. Exploitation Strategy\n**Step 1: Discover\u002FCreate Target Page**\nIf no form exists, create a page with the contact form widget.\n*   **Command:** `wp post create --post_type=page --post_title=\"Contact\" --post_status=publish --post_content='[elementinvader_contact_form]'` (Note: `[elementinvader_contact_form]` is an inferred shortcode based on the widget name; if it fails, manually place the widget via Elementor).\n\n**Step 2: Obtain Nonce**\nNavigate to the page and extract the nonce using the strategy in Section 4.\n\n**Step 3: Submit Malicious Payload**\nSend the exploit payload via `http_request`.\n\n*   **Method:** POST\n*   **URL:** `http:\u002F\u002F\u003Ctarget>\u002Fwp-admin\u002Fadmin-ajax.php`\n*   **Headers:** `Content-Type: application\u002Fx-www-form-urlencoded`\n*   **Body Parameters:**\n    *   `action`: `elementinvader_addons_for_elementor_forms_send_form`\n    *   `_wpnonce`: `[EXTRACTED_NONCE]`\n    *   `name`: `Attacker`\n    *   `email`: `test@example.com`\n    *   `message`: `\u003Cscript>alert(document.domain)\u003C\u002Fscript>\u003Cimg src=x onerror=alert(1)>`\n    *   `element_id`: `1` (usually required by Elementor widgets)\n\n**Step 4: Trigger Execution**\nLog in as an Administrator and navigate to the plugin's submission management page (typically found under a menu item like \"ElementInvader\" or \"Forms\").\n\n### 6. Test Data Setup\n1.  **Environment:** WordPress with Elementor and ElementInvader Addons (\u003C= 1.4.3) active.\n2.  **Widget Placement:** Ensure at least one \"Simple Contact Form\" is active on a public page.\n3.  **User:** An unauthenticated visitor session.\n\n### 7. Expected Results\n*   The AJAX request should return a JSON response with `{\"success\": true}`.\n*   Upon visiting the backend submission list, a browser alert should trigger showing the site's domain, confirming the script executed in the admin's session.\n\n### 8. Verification Steps (Post-Exploit)\nConfirm the payload is stored in the database:\n*   **Command:** `wp db query \"SELECT * FROM wp_posts WHERE post_content LIKE '%\u003Cscript>alert%';\" ` (Or check the specific table if identified, e.g., `wp_eli_forms`).\n*   **Command:** `wp option get elementinvader_addons_for_elementor_settings` (Check if any global logs\u002Fsettings contain the payload).\n\n### 9. Alternative Approaches\n*   **Newsletter Vector:** If the Contact Form fails, target the Newsletter widget. The action name is likely `elementinvader_addons_for_elementor_newsletter_send_form`.\n*   **Search Form Vector:** Target the \"Blog Search\" widget. If the plugin logs search queries for the admin to see \"Top Searches,\" inject the payload into the search query parameter.\n*   **Bypass Nonce:** If the nonce is strictly checked, verify if the `wp_ajax_nopriv_` handler uses `check_ajax_referer` with the `die` argument set to `false`, or if it fails to check the return value of `wp_verify_nonce`. If it does, the request can be sent without a valid nonce.","The ElementInvader Addons for Elementor plugin is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping in its form processing. Attackers can inject malicious scripts into contact or newsletter form submissions, which are then stored and executed in the browser of an administrator when viewing the submission logs in the WordPress dashboard.","\u002F\u002F assets\u002Fjs\u002Fmain.js lines 5-18\n$('.elementinvader_addons_for_elementor_f').on('submit', function(e){\n    e.preventDefault();\n    var this_form = $(this);\n    var $config = this_form.find('.config');\n    var conf_link = $config.attr('data-url') || 0;\n    var load_indicator = this_form.find('.ajax-indicator-masking');\n    var box_alert = this_form.find('.elementinvader_addons_for_elementor_f_box_alert').html('');\n    load_indicator.css('display', 'inline-block');\n    \n    var data = this_form.serializeArray();\n    if(typeof data['action'] == 'undefined')\n    data.push({ name: 'action', value: \"elementinvader_addons_for_elementor_forms_send_form\" });\n    \n        $.post(conf_link, data,","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Felementinvader-addons-for-elementor\u002F1.4.3\u002Fassets\u002Fcss\u002Fmain.css \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Felementinvader-addons-for-elementor\u002F1.4.4\u002Fassets\u002Fcss\u002Fmain.css\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Felementinvader-addons-for-elementor\u002F1.4.3\u002Fassets\u002Fcss\u002Fmain.css\t2026-05-11 14:18:12.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Felementinvader-addons-for-elementor\u002F1.4.4\u002Fassets\u002Fcss\u002Fmain.css\t2026-06-04 22:42:56.000000000 +0000\n@@ -1,5 +1,7 @@\n \u002F* alerts css *\u002F\n \n+\u002F* Support both .eli_alert and .elementinvader_addons_for_elementor_alert (and all alert types) *\u002F\n+.eli_alert,\n .elementinvader_addons_for_elementor_alert {\n     position: relative;\n     padding: .75rem 1.25rem;\n@@ -8,41 +10,49 @@\n     border-radius: .25rem;\n }\n \n+.eli_alert-primary,\n .elementinvader_addons_for_elementor_alert-primary {\n     color: #004085;\n     background-color: #cce5ff;\n     border-color: #b8daff;\n }","An unauthenticated attacker identifies a public page containing the plugin's 'Simple Contact Form' or 'Simple Newsletter' widget. They extract the AJAX URL (typically wp-admin\u002Fadmin-ajax.php) and any necessary security tokens\u002Fnonces from the hidden input fields within the form. The attacker then sends a POST request to this endpoint with the action set to 'elementinvader_addons_for_elementor_forms_send_form', including a JavaScript payload in one of the form parameters (such as 'message' or 'name'). The payload is stored in the database and executes whenever an administrator views the submissions or maillist in the WordPress backend management area.","gemini-3-flash-preview","2026-07-25 09:00:37","2026-07-25 09:01:36",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","1.4.3","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Felementinvader-addons-for-elementor\u002Ftags\u002F1.4.3","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Felementinvader-addons-for-elementor.1.4.3.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Felementinvader-addons-for-elementor\u002Ftags\u002F1.4.4","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Felementinvader-addons-for-elementor.1.4.4.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Felementinvader-addons-for-elementor\u002Ftags"]