Premium Addons for Elementor <= 4.11.84 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'premium_tooltip_text' Parameter
Description
The Premium Addons for Elementor – Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'premium_tooltip_text' parameter in all versions up to, and including, 4.11.84 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is specifically triggered when an administrator or higher-privileged user opens the affected post in the Elementor editor, as the raw unescaped output occurs via the print_template() method registered on the 'elementor/section/print_template' hook rather than on the public-facing frontend.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:NTechnical Details
<=4.11.84What Changed in the Fix
Changes introduced in v4.11.85
Source Code
WordPress.org SVNI cannot fulfill your request to produce a detailed exploitation research plan or provide actionable payloads for this specific vulnerability. My instructions prohibit the generation of materials that could facilitate a cyberattack on a concrete target, including the analysis of specific code paths …
Show full research plan
I cannot fulfill your request to produce a detailed exploitation research plan or provide actionable payloads for this specific vulnerability. My instructions prohibit the generation of materials that could facilitate a cyberattack on a concrete target, including the analysis of specific code paths for exploitation and the creation of step-by-step exploit guides.
If you are interested in learning about WordPress security and how to protect plugins from similar vulnerabilities, I recommend exploring the following general security resources:
- WordPress Plugin Handbook (Security Section): This is the official guide for plugin developers and covers essential topics like data sanitization, output escaping, and proper nonce implementation.
- OWASP Top 10 - Cross-Site Scripting (XSS): This resource provides a deep dive into the mechanics of XSS, common attack patterns, and robust prevention strategies applicable to all web applications.
- WordPress Developer Documentation: Search for specific functions like
esc_html(),esc_attr(),wp_kses(), andwp_verify_nonce()to understand their intended use and security implications. - Common Vulnerabilities and Exposures (CVE) Databases: Reviewing historical XSS vulnerabilities in WordPress plugins (through sites like WPScan or the CVE database) can provide insights into common coding errors and how they were remediated by developers.
Focusing on these defensive principles and best practices will help you build and maintain secure WordPress extensions.
Summary
The Premium Addons for Elementor plugin is vulnerable to Stored Cross-Site Scripting via the 'premium_tooltip_text' parameter in versions up to 4.11.84. This vulnerability exists because the plugin fails to sanitize or escape the tooltip content when rendering it within the Elementor editor's print_template() method, allowing authenticated contributors to execute arbitrary scripts in the session of a higher-privileged user (like an administrator) who opens the affected page in the editor.
Security Fix
@@ -78,7 +78,8 @@ } .pa-control.slider, -.pa-control.pro-slider { +.pa-control.pro-slider, +.pa-control.pa-wp-ver-slider { position: absolute; cursor: pointer; top: 0; @@ -92,7 +93,8 @@ } .pa-control.slider::before, -.pa-control.pro-slider::before { +.pa-control.pro-slider::before, +.pa-control.pa-wp-ver-slider::before { position: absolute; content: ""; inset-inline-start: 3px; @@ -129,19 +131,22 @@ } .pa-control.slider.round, -.pa-control.pro-slider.round { +.pa-control.pro-slider.round, +.pa-control.pa-wp-ver-slider.round { border-radius: 34px; background-image: -webkit-linear-gradient(top, #cfcfcf 0%, #dbdbdb 100%); background-image: linear-gradient(180deg, #cfcfcf 0%, #dbdbdb 100%); } .pa-control.slider.round::before, -.pa-control.pro-slider.round::before { +.pa-control.pro-slider.round::before, +.pa-control.pa-wp-ver-slider.round::before { border-radius: 50%; } #pa-settings .switch input:disabled + .pro-slider::after, -#pa-features-settings .switch input:disabled + .pro-slider::after { +#pa-features-settings .switch input:disabled + .pro-slider::after, +#pa-features-settings .switch input:disabled + .pa-wp-ver-slider::after { position: absolute; font-family: Dashicons, sans-serif; content: "\f160"; ... (truncated)
Exploit Outline
1. Authenticate as a Contributor or higher-level user and open the Elementor editor for a new or existing post. 2. Locate the 'Premium Tooltips' extension settings (often found under the Advanced tab for widgets or sections). 3. Enable the tooltip feature and find the 'premium_tooltip_text' parameter field. 4. Enter a malicious JavaScript payload into this field, such as: <script>alert(document.cookie)</script>. 5. Save the post to store the payload in the database. 6. The script will be triggered when an Administrator or Editor subsequently opens the same post in the Elementor editor, as the plugin renders the raw content in its JavaScript-based editor template via the print_template() method.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.