CVE-2024-9444 identifies a stored cross-site scripting vulnerability in the ElementsReady Addons for Elementor plugin for WordPress, present in all versions up to and including 6.4.3. The vulnerability stems from improper neutralization of input during web page generation (CWE-79), specifically related to the handling of SVG file uploads. Authenticated users with Author-level or higher privileges can upload SVG files containing embedded malicious JavaScript. Due to insufficient sanitization and output escaping, these scripts are stored and subsequently executed in the browsers of any users who access the pages containing the SVG files. This stored XSS can lead to session hijacking, privilege escalation, defacement, or distribution of malware. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting medium severity, with an attack vector of network, low attack complexity, requiring privileges but no user interaction, and impacting confidentiality and integrity with a scope change. No patches or fixes are currently linked, and no known exploits are reported in the wild. The vulnerability highlights the risk of allowing authenticated users to upload SVG content without proper sanitization, a common vector for XSS attacks in web applications.

The impact of this vulnerability is significant for organizations running WordPress sites using the ElementsReady Addons for Elementor plugin, especially those allowing multiple users with Author-level or higher permissions. Exploitation can lead to unauthorized script execution in the context of site visitors or administrators, enabling theft of authentication cookies, defacement, redirection to malicious sites, or further compromise of the WordPress environment. This can damage organizational reputation, lead to data breaches, and facilitate lateral movement within the network if administrative accounts are compromised. Since the attack requires authenticated access, insider threats or compromised user accounts pose a direct risk. The vulnerability affects confidentiality and integrity but does not impact availability. Given the widespread use of WordPress and Elementor plugins globally, the potential attack surface is large, particularly for content-heavy or multi-author websites.

Organizations should immediately restrict upload permissions to trusted users only and monitor for suspicious SVG uploads. Since no official patches are currently linked, temporary mitigations include disabling SVG uploads or filtering SVG content to remove scripts using specialized sanitization libraries such as SVG Sanitizer or OWASP Java HTML Sanitizer. Implement Content Security Policy (CSP) headers to restrict script execution from untrusted sources. Regularly audit user roles and permissions to minimize the number of users with Author-level or higher access. Monitor web server logs and WordPress activity logs for unusual file uploads or page modifications. Once a patch is released by quomodosoft, promptly apply it. Additionally, consider using Web Application Firewalls (WAFs) with rules targeting SVG-based XSS payloads to block exploitation attempts.