CVE-2024-1536 Overview
CVE-2024-1536 is a Stored Cross-Site Scripting (XSS) vulnerability in the Essential Addons for Elementor plugin for WordPress. The flaw affects all versions up to and including 5.9.9 and resides in the plugin's event calendar widget. The plugin fails to properly sanitize user-supplied attributes and escape output, allowing authenticated attackers with contributor-level permissions or higher to inject arbitrary JavaScript. Injected scripts execute in the browser of any user who views the affected page. The vulnerability is tracked as [CWE-79] and was patched in version 5.9.10.
Critical Impact
Authenticated contributors can persistently inject JavaScript that executes in visitor and administrator browsers, enabling session theft, account takeover, and site defacement.
Affected Products
- WPDeveloper Essential Addons for Elementor (Lite) — all versions through 5.9.9
- WordPress sites running the plugin with contributor-level or higher user registration
- Fixed in Essential Addons for Elementor version 5.9.10
Discovery Timeline
- 2024-03-13 - CVE-2024-1536 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-1536
Vulnerability Analysis
The vulnerability exists in the event calendar widget shipped with Essential Addons for Elementor. The widget accepts user-supplied attributes that are rendered back into page markup without adequate input sanitization or output escaping. An authenticated user with contributor-level access can craft widget attributes containing JavaScript payloads. Once saved, the payload is stored in the WordPress database and executed in the browser of every user who loads the page containing the widget. Because the payload runs in the context of the vulnerable site, it can access session cookies, perform actions on behalf of authenticated administrators, and modify page content.
Root Cause
The root cause is missing input validation and output escaping in the Event_Calendar.php component of the plugin. User-controlled attributes reach the HTML rendering path without passing through WordPress escaping functions such as esc_attr() or esc_html(). The upstream fix in the 5.9.10changeset adds sanitization to the affected attribute handling.
Attack Vector
Exploitation requires an authenticated account with contributor or higher role. The attacker edits a page or post, inserts the event calendar widget, and supplies a malicious value for one of the vulnerable attributes. The payload is stored persistently. When any subsequent visitor, including administrators, loads the page, the injected script executes with the privileges of that user's session. This changes the scope from the attacker's account to any other authenticated user, which is why the CVSS scope is marked as changed.
No public proof-of-concept is available at the time of publication. For technical details, consult the Wordfence Vulnerability Report.
Detection Methods for CVE-2024-1536
Indicators of Compromise
- Event calendar widget attributes containing <script>, onerror=, onload=, or javascript: patterns in wp_postmeta or wp_posts tables
- Unexpected outbound requests from administrator browsers to attacker-controlled domains after loading pages with the event calendar widget
- New or modified WordPress administrator accounts created shortly after contributor account activity
Detection Strategies
- Query the WordPress database for post content and postmeta rows containing event calendar shortcodes with suspicious attribute values
- Review plugin installations and compare installed versions against 5.9.10 or later
- Monitor authentication logs for contributor-level accounts editing pages that contain Elementor widgets
Monitoring Recommendations
- Enable web application firewall (WAF) logging for requests to wp-admin/post.php and wp-admin/admin-ajax.php containing Elementor payloads
- Alert on responses served to administrators that contain script tags originating from post content fields
- Track user role changes and privilege escalation events in the WordPress activity log
How to Mitigate CVE-2024-1536
Immediate Actions Required
- Update Essential Addons for Elementor to version 5.9.10 or later on all WordPress installations
- Audit all pages using the event calendar widget for injected script content before and after patching
- Review contributor and author accounts, disable inactive or unrecognized users, and rotate credentials for administrator accounts
Patch Information
WPDeveloper released the fix in Essential Addons for Elementor version 5.9.10. The patched code is available in the WordPress plugin repository changeset 3037755, which adds sanitization to the vulnerable attribute handling in Event_Calendar.php.
Workarounds
- Temporarily deactivate the Essential Addons for Elementor plugin until the update to 5.9.10 is applied
- Restrict contributor and author roles from using the event calendar widget through a role management plugin
- Deploy a WAF rule to block requests containing script tags or JavaScript event handlers in Elementor widget attributes
# Update Essential Addons for Elementor via WP-CLI
wp plugin update essential-addons-for-elementor-lite --version=5.9.10
# Verify installed version
wp plugin get essential-addons-for-elementor-lite --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
