CVE-2024-51575

Vulnerability

Improper neutralization of user-supplied input during web page generation in the WordPress plugin 'Extender All In One For Elementor' (slug: extender-all-in-one-for-elementor) leads to a stored Cross-Site Scripting (XSS) flaw. The vulnerability affects all versions up to and including 1.0.3. The plugin has been closed/removed from the WordPress.org plugin directory due to an unfixed security issue [1].

Exploitation

An attacker with contributor-level access or higher (or any role that can submit content handled by the plugin) can inject a malicious XSS payload into input fields processed by the plugin. The script is stored on the server and executed in the browser of any user who views the affected page.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's session, leading to session hijacking, defacement, or theft of sensitive data. The compromise occurs at the user's privilege level, but can chain with other attacks.

Mitigation

No patched version exists; the plugin has been removed from the official WordPress repository as of October 24, 2024, and is unavailable for download [1]. Users should immediately uninstall 'Extender All In One For Elementor' and replace it with an alternative solution. As of this writing the CVE is not listed on CISA's Known Exploited Vulnerabilities catalog.