CVE-2024-11367: Smoove Connector Elementor XSS Vulnerability

CVE-2024-11367 Overview

The Smoove connector for Elementor forms plugin for WordPress contains a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79]. The flaw affects all plugin versions up to and including 4.1.0. The root cause is the use of add_query_arg without proper escaping on the URL. Unauthenticated attackers can inject arbitrary web scripts into pages rendered by the plugin. Exploitation requires user interaction, such as clicking a crafted link. Successful execution runs attacker-controlled JavaScript in the victim's browser session on the affected WordPress site.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session when the victim clicks a crafted link, enabling session theft, credential harvesting, or administrative actions.

Affected Products

Smoove connector for Elementor forms plugin for WordPress
All versions up to and including 4.1.0
WordPress sites using the smoove-elementor plugin

Discovery Timeline

2024-12-07 - CVE-2024-11367 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11367

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting flaw in the Smoove connector for Elementor forms plugin. The plugin uses the WordPress add_query_arg function without properly escaping the URL output. When add_query_arg is called without sanitization, it can reflect attacker-controlled query parameters directly into HTML attributes such as form actions or anchor href values. Attackers craft URLs containing malicious script payloads and deliver them to authenticated administrators or site visitors. When the victim loads the crafted URL, the injected payload executes within the site's origin. Consequences include session hijacking, forced administrative actions, redirection to attacker infrastructure, and phishing overlays on the trusted domain.

Root Cause

The root cause is improper output encoding in the plugin's admin interface. The affected code path referenced in inc/modules/api-logs-table.php around line 134 passes the current request URL to add_query_arg and echoes the result without wrapping it in esc_url or esc_attr. WordPress documentation explicitly warns that add_query_arg returns unescaped data and that developers must escape the output before rendering it in HTML context.

Attack Vector

Exploitation occurs over the network and requires user interaction. An attacker constructs a URL to a vulnerable page on the target WordPress site that includes a crafted query string containing JavaScript. The attacker delivers the link through email, social media, or an external site. When the victim clicks the link while viewing an affected page, the browser renders the reflected payload and executes it in the site's security context. Because scope changes to affect other components, the payload can access cookies, DOM elements, and session tokens beyond the vulnerable component itself.

No verified exploit code is publicly available. See the Wordfence Vulnerability Analysis and the WordPress Plugin Code Reference for technical context.

Detection Methods for CVE-2024-11367

Indicators of Compromise

HTTP GET requests to WordPress admin pages containing URL-encoded <script>, javascript:, onerror=, or onload= payloads in query parameters
Referer headers originating from untrusted external domains pointing to wp-admin pages tied to the smoove-elementor plugin
Web server access logs showing repeated requests to plugin admin endpoints with abnormally long or encoded query strings
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after clicking external links

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that inspects query strings for common XSS payload patterns targeting /wp-admin/ paths
Monitor WordPress audit logs for administrator actions that follow suspicious inbound referrers
Correlate email gateway telemetry with WordPress access logs to identify phishing links pointing at the vulnerable plugin

Monitoring Recommendations

Enable verbose HTTP access logging on the WordPress host and forward logs to a centralized analytics platform for pattern matching
Alert on any administrator session that submits form actions immediately after loading a URL with encoded script characters
Track plugin version inventory across WordPress deployments to identify hosts still running Smoove connector 4.1.0 or earlier

How to Mitigate CVE-2024-11367

Immediate Actions Required

Update the Smoove connector for Elementor forms plugin to a version later than 4.1.0 once the vendor publishes a fixed release
Disable or remove the plugin on affected WordPress sites until a patched version is installed
Instruct WordPress administrators to avoid clicking untrusted links while authenticated to the admin console
Rotate administrator session cookies and credentials if suspicious access patterns are observed

Patch Information

Review the vendor changeset history at the WordPress Plugin Changeset History and the Wordfence Vulnerability Analysis for the current fix status. Apply the vendor-supplied update as soon as it is available through the WordPress plugin update channel.

Workarounds

Deploy a WAF rule that blocks requests containing XSS payload signatures targeting the plugin's admin pages
Restrict access to the WordPress admin interface by source IP address using web server configuration or a reverse proxy
Enforce a strict Content Security Policy (CSP) that disallows inline script execution to reduce reflected XSS impact

bash

# Example nginx location block restricting wp-admin to trusted IPs
location /wp-admin/ {
    allow 203.0.113.0/24;
    deny all;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'";
}