Security Vulnerabilities in the Elementor Add-on Plugin and How to Protect Your WordPress Site

Elementor researchers have issued security advisories for 11 separate Elementor add-ons containing 15 vulnerabilities. These vulnerabilities could enable hackers to upload malicious files, and one is rated as a high-threat vulnerability because it could allow hackers to bypass access controls, execute scripts, and access sensitive data.

Two different types of vulnerabilities

1. Storing cross-site scripting (XSS)

XSS vulnerabilities are one of the most common forms of vulnerabilities in WordPress plugins and themes. They are usually caused by flaws in the way input data is protected (input cleanup) and the way output data is locked (output escaping).

2. Local File Containment Vulnerability

A local file inclusion vulnerability is a vulnerability that exploits an insecure user input area, allowing an attacker to "include" files in the input. Simply put, this vulnerability allows an attacker to "include" a variety of code that can bypass any restrictions on what can be performed and/or access allowed on a website.

List of Vulnerable Elementor Add-ons

In total, 11 Elementor add-ons have reported vulnerabilities, some of which have multiple vulnerabilities. Below is the list of add-ons and their vulnerabilities in descending order from newest to oldest:

1. ElementsKit Elementor addons (x2)
2. Unlimited Elements For Elementor
3. 140+ Widgets | Best Addons For Elementor
4. Better Elementor Addons
5. Elementor Addon Elements (x2)
6. Master Addons for Elementor
7. The Plus Addons for Elementor (x2)
8. Essential Addons for Elementor (x2)
9. Element Pack Elementor Addons
10. Prime Slider - Addons For Elementor
11. Move Addons for Elementor

High Severity Vulnerabilities

The high severity vulnerability found in the ElementsKit Elementor Addons plugin for WordPress is particularly concerning as it could put over a million websites at risk. The vulnerability has a rating of 8.8 (on a scale of 1-10). The plugin's popularity is due to its all-in-one feature that allows users to easily modify almost any page design feature in the header, footer, and menu.

Affected WordPress sites

These vulnerabilities could affect over 3 million websites. The total number of active installations of just two of these plugins is 3 million. Below is a list of vulnerable plugins by number of installations:

1. Essential Addons for Elementor - 2 Million
2. ElementsKit Elementor addons - 1 Million
3. Unlimited Elements For Elementor - 200k
4. Elementor Addon Elements - 100k
5. The Plus Addons for Elementor - 100k
6. Element Pack Elementor Addons - 100k
7. Prime Slider - Addons For Elementor - 100k
8. Master Addons for Elementor - 40k
9. 140+ Widgets | Best Addons For Elementor - 10k
10. Move Addons for Elementor - 3k
11. Better Elementor Addons - Unknown - Closed By WordPress

Recommended Operation

While many medium severity vulnerabilities require hackers to obtain contributor level authentication to launch an attack, the risk posed by other plugins or installed themes should not be underestimated. These plugins or themes may grant attackers the ability to launch these specific attacks. Here are some suggested steps to take:

1. Update plugins and themes::
   • Make sure all Elementor add-ons and themes are updated to the latest version.
   • Test updated themes and plugins before pushing updates to the live site.
2. Clearing Cache and Cookies::
   • Clear your browser cache and cookies regularly to avoid potential security breaches.
3. Using Safe Mode::
   • Enable Elementor's "Safe Mode" to separate the core of Elementor from themes and plugins that may cause problems.
4. Checking the server connection::
   • Ensure that your Internet connection is stable and contact your hosting provider if necessary.
5. Enabling CDN::
   • Use content delivery networks (CDNs) to distribute web content to servers around the world, reducing the burden on the main server.
6. Seek professional support::
   • If you are unable to resolve the issue, you can contact the Elementor support team for assistance.

By taking these measures, you can effectively minimize the security risks caused by the vulnerabilities of Elementor add-ons and safeguard the security and stability of your website.