CVE-2024-5344: Plus Addons for Elementor XSS Vulnerability

CVE-2024-5344 Overview

CVE-2024-5344 is a Reflected Cross-Site Scripting (XSS) vulnerability in The Plus Addons for Elementor Page Builder plugin for WordPress. The flaw exists in the forgoturl attribute of the plugin's WP Login & Register widget. All versions up to and including 5.5.6 are affected. Unauthenticated attackers can inject arbitrary web scripts that execute when a user clicks a crafted link. The vulnerability is tracked under CWE-79 and stems from insufficient input sanitization and output escaping. Full details are available in the Wordfence Vulnerability Report.

Critical Impact
Successful exploitation enables session hijacking, credential theft, and browser-based attacks against WordPress site visitors and administrators who click a crafted URL.

Affected Products

Posimyth The Plus Addons for Elementor Page Builder for WordPress
All versions up to and including 5.5.6
WP Login & Register widget component

Discovery Timeline

2024-06-21 - CVE-2024-5344 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-5344

Vulnerability Analysis

The vulnerability resides in the WP Login & Register widget provided by The Plus Addons for Elementor plugin. The widget renders the forgoturl attribute value into the HTML output without adequate sanitization or context-appropriate escaping. When an attacker supplies a crafted value through this parameter, the payload is reflected back to the browser and executed in the victim's session context. Because the widget is reachable to unauthenticated visitors on any page where it is embedded, exploitation does not require prior access to the WordPress site.

Root Cause

The root cause is a classic Reflected Cross-Site Scripting weakness [CWE-79]. The plugin fails to apply WordPress sanitization functions such as esc_url() or esc_attr() to the forgoturl parameter before echoing it into the widget's rendered markup. As a result, JavaScript expressions or event handlers injected into the parameter are interpreted by the browser rather than treated as inert data.

Attack Vector

Exploitation requires user interaction. An attacker crafts a URL containing a malicious forgoturl payload targeting a page that renders the WP Login & Register widget. The attacker then delivers the URL through phishing emails, social media, or malicious advertising. When the victim visits the link, the injected script executes under the origin of the vulnerable WordPress site. Attackers can use this to steal session cookies, perform actions on behalf of the victim, redirect users to attacker-controlled sites, or deliver browser exploits. Because the scope is changed (S:C), the impact can cross security boundaries, affecting the WordPress admin session if a privileged user clicks the link. No verified public proof-of-concept code is available; refer to the Wordfence Vulnerability Report for further technical detail.

Detection Methods for CVE-2024-5344

Indicators of Compromise

HTTP requests containing suspicious values in the forgoturl query parameter, particularly strings containing <script>, javascript:, onerror=, or encoded variants.
Unusual outbound requests from browsers of users who recently visited pages hosting the WP Login & Register widget.
WordPress admin session anomalies such as unexpected plugin installations, new administrator accounts, or content modifications following user link clicks.

Detection Strategies

Inspect web server access logs for GET requests referencing the WP Login & Register widget with encoded script payloads in forgoturl.
Deploy a Web Application Firewall (WAF) with rules that identify reflected XSS payload patterns in query parameters.
Enumerate installed WordPress plugins and flag Posimyth The Plus Addons for Elementor at version 5.5.6 or earlier.

Monitoring Recommendations

Alert on repeated requests to pages containing the login/register widget with parameters that fail sanitization heuristics.
Monitor browser telemetry for script execution originating from URLs bearing the forgoturl parameter.
Track WordPress audit logs for changes to administrator accounts or plugin settings correlated with recent link-click activity.

How to Mitigate CVE-2024-5344

Immediate Actions Required

Update The Plus Addons for Elementor plugin to a version later than 5.5.6 as published on the Plus Addons Updates roadmap.
Audit all Elementor-built pages that embed the WP Login & Register widget and confirm whether they were exposed.
Rotate WordPress administrator credentials and invalidate active sessions if suspicious activity is observed.

Patch Information

Posimyth addressed the flaw in a release subsequent to 5.5.6. Consult the vendor's Plus Addons Updates page and the Wordfence Vulnerability Report for the fixed version identifier and change details.

Workarounds

Remove or disable the WP Login & Register widget from all published pages until the plugin is updated.
Deploy WAF rules that block requests containing script tags, javascript: schemes, or common XSS payload patterns in the forgoturl parameter.
Enforce a strict Content Security Policy (CSP) that disallows inline script execution on WordPress front-end pages.
Train administrators to avoid clicking untrusted links to their own WordPress site while authenticated.

bash

# Example WAF rule (ModSecurity) to block reflected XSS attempts against forgoturl
SecRule ARGS:forgoturl "@rx (?i)(<script|javascript:|onerror=|onload=|%3Cscript)" \
  "id:1005344,phase:2,deny,status:403,log,msg:'CVE-2024-5344 XSS attempt in forgoturl parameter'"