Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Image Box Widget

Vulnerability

The Elementor Website Builder plugin for WordPress prior to version 3.1.4 contains a stored cross-site scripting (XSS) vulnerability in the image box widget (includes/widgets/image-box.php). The 'title_size' parameter accepts user input but is not properly sanitized or escaped. Although the element control restricts allowed HTML tags, an attacker with Contributor-level permissions or higher can bypass this by sending a modified 'save_builder' request with malicious JavaScript in the 'title_size' parameter. [1]

Exploitation

An attacker must have at least Contributor role in WordPress. They craft a request to the 'save_builder' endpoint with arbitrary JavaScript code in the 'title_size' parameter. The plugin does not filter or escape this input, so the payload is stored. When a page containing the image box widget is viewed or previewed, the JavaScript executes in the context of the victim's browser. [1]

Impact

Successful exploitation leads to stored XSS, allowing the attacker to execute arbitrary JavaScript in the browser of any user visiting the affected page. This can result in session hijacking, defacement, or redirection to malicious sites. The attacker gains the ability to perform actions on behalf of the victim within the WordPress admin, limited by the victim's privileges. [1]

Mitigation

The vulnerability is fixed in Elementor version 3.1.4, released on 2021-03-17. Users should update to version 3.1.4 or later. For sites running an older version, the only workaround is to restrict Contributor and higher roles to trusted users, as no plugin-level workaround is available. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of the publication date. [1]