CVE-2024-38718

Vulnerability

Overview

The Download Button for Elementor plugin for WordPress versions up to and including 1.2.1 contains a stored cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation [1]. This flaw allows attackers to inject arbitrary web scripts into pages that are executed when other users access the affected page.

Exploitation

Exploitation requires a privileged user (e.g., administrator) to perform an action such as clicking a malicious link or submitting a crafted form. Once triggered, the injected script is stored and executed for subsequent visitors. The vulnerability can be initiated by roles with sufficient privileges, but successful execution depends on user interaction [1].

Impact

An attacker can inject malicious scripts, including redirects, advertisements, or other HTML payloads, which are executed in the context of the victim's browser when they visit the compromised site. This can lead to defacement, data theft, or further compromise of user sessions.

Mitigation

The vendor has not released a patched version; users should update the plugin to a safe version if available, or remove it. As a workaround, apply a web application firewall (WAF) rule to block malicious inputs. Given the active exploitation risk, immediate action is recommended [1].