CVE-2024-44007: SKT Templates Plugin XSS Vulnerability

CVE-2024-44007 Overview

CVE-2024-44007 is a reflected Cross-Site Scripting (XSS) vulnerability in the SKT Templates – Elementor & Gutenberg templates plugin for WordPress, developed by sonalsinha21. The flaw affects all versions of skt-templates up to and including 6.14. It stems from improper neutralization of user-supplied input during web page generation [CWE-79]. An unauthenticated attacker can craft a malicious URL that, when visited by a target user, executes arbitrary JavaScript in the victim's browser session under the site's origin.

Critical Impact
Successful exploitation allows attackers to execute arbitrary script in a victim's browser, enabling session hijacking, credential theft, or redirection to attacker-controlled infrastructure. User interaction is required.

Affected Products

SKT Templates – Elementor & Gutenberg templates (skt-templates) plugin for WordPress
All versions from initial release through 6.14
WordPress sites running the vulnerable plugin with sktthemes as the vendor

Discovery Timeline

2024-09-17 - CVE-2024-44007 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-44007

Vulnerability Analysis

The vulnerability is a reflected XSS flaw classified under [CWE-79]: Improper Neutralization of Input During Web Page Generation. The plugin accepts input from HTTP request parameters and reflects it back into the rendered HTML response without adequate sanitization or output encoding. An attacker crafts a URL containing malicious JavaScript in a vulnerable parameter and delivers it to a target through phishing, social engineering, or a malicious link on a third-party site.

When the victim clicks the link, the browser sends the payload to the WordPress site. The site echoes the payload into the response, and the browser executes it in the context of the site's origin. Because the CVSS scope is changed, the injected script can affect resources beyond the vulnerable component, including administrator sessions and cross-origin content within the same browsing context.

Root Cause

The root cause is missing or insufficient input validation and output encoding within request handlers in skt-templates version 6.14 and earlier. Reflected user input is inserted into HTML, attribute, or script contexts without contextual escaping, allowing a browser to interpret attacker-controlled data as executable script.

Attack Vector

Exploitation occurs over the network and requires user interaction. An attacker crafts a URL to the vulnerable WordPress endpoint with a JavaScript payload embedded in an affected parameter. The victim must click the link or load the crafted page. No authentication is required from the attacker, though the impact scales with the privileges of the victim. If an administrator is targeted, the attacker can perform actions on the site using the administrator's authenticated session. See the Patchstack XSS Vulnerability Advisory for advisory details.

Detection Methods for CVE-2024-44007

Indicators of Compromise

HTTP GET requests to WordPress endpoints associated with the skt-templates plugin containing URL-encoded <script>, onerror=, onload=, or javascript: payloads in query parameters
Referer headers originating from unfamiliar external domains delivering crafted links to site users
Unexpected outbound requests from browser sessions to attacker-controlled hosts following administrator or editor logins

Detection Strategies

Inspect web server access logs for query strings containing HTML tags, event handler attributes, or encoded script fragments targeting skt-templates routes
Deploy a Web Application Firewall (WAF) rule set with signatures for reflected XSS patterns targeting WordPress plugin parameters
Enumerate installed WordPress plugins and flag any host running skt-templates version 6.14 or earlier

Monitoring Recommendations

Forward WordPress access logs, WAF events, and browser Content Security Policy (CSP) violation reports to a centralized analytics platform for correlation
Alert on administrator sessions that generate anomalous DOM activity, unexpected AJAX requests, or new administrator account creation shortly after link clicks
Track plugin version inventory across managed WordPress sites and generate alerts when vulnerable versions are detected

How to Mitigate CVE-2024-44007

Immediate Actions Required

Update the SKT Templates – Elementor & Gutenberg templates plugin to a version later than 6.14 as soon as a fixed release is available from the vendor
If no patched version is available, deactivate and remove the skt-templates plugin from all WordPress installations
Rotate credentials and invalidate active sessions for administrator accounts on any site where exploitation is suspected

Patch Information

The vulnerability affects skt-templates through version 6.14. Consult the Patchstack advisory and the WordPress plugin repository for the latest fixed release. Apply the update through the WordPress admin dashboard or via wp-cli.

Workarounds

Deploy a WAF rule to block requests to plugin endpoints containing script tags, event handlers, or JavaScript URI schemes in query parameters
Enforce a strict Content Security Policy (CSP) that disallows inline scripts and restricts script sources to trusted origins
Restrict administrator access to trusted networks and require multi-factor authentication (MFA) to reduce the impact of session compromise

bash

# Example: update the plugin via wp-cli once a fixed version is released
wp plugin update skt-templates

# Example: deactivate and remove the plugin if no patch is available
wp plugin deactivate skt-templates
wp plugin delete skt-templates