Urgent Advisory — Reflected XSS in “Primary Addon for Elementor” (≤ 1.6.0): What Every WordPress Site Owner Must Do

Published: 2026-05-01 · Author: Hong Kong Security Expert

Summary: An unauthenticated reflected Cross-Site Scripting (XSS) vulnerability (CVE-2024-13362) affects the Primary Addon for Elementor plugin in versions up to and including 1.6.0. The vendor’s patched release is 1.6.5. If your site uses this plugin and is not updated, take immediate action.

Table of contents

• What happened (summary)
• Understanding reflected XSS and why this matters
• The specifics (what the advisory tells us)
• Exploitation scenarios and impact
• How to detect if your site is being targeted or exploited
• Immediate mitigation steps (short-term)
• Permanent resolution (updating safely)
• Virtual patching and practical guidance
• WAF signature examples and recommendations
• Hardening checklist (for site owners and developers)
• Incident response: if you think your site was compromised
• How to safely test that the vulnerability is fixed
• Choosing protection and next steps
• Closing notes and recommended next steps

What happened (summary)

A reflected Cross-Site Scripting (XSS) vulnerability (CVE-2024-13362) was disclosed for the “Primary Addon for Elementor” plugin. The issue affects plugin versions ≤ 1.6.0 and was patched by the author in version 1.6.5.

• An unauthenticated attacker can craft a URL containing malicious input that the plugin reflects into a page without proper sanitization/encoding.
• A victim must visit the crafted URL for the malicious script to execute in their browser.
• Updating to version 1.6.5 or later removes the vulnerable code path.

Although some listings mark the severity as “low” (published CVSS 6.1), unauthenticated reflected XSS in a popular plugin warrants immediate attention: attackers can weaponize it for phishing, session theft, drive-by attacks and other secondary harms.

Understanding reflected XSS and why this matters

Cross-Site Scripting (XSS) allows attacker-controlled scripts to run in the context of a trusted website. Three common varieties:

• Stored XSS — payloads persist on the server and execute later.
• Reflected XSS — payloads are delivered in the response to a crafted request (often via URL parameters).
• DOM-based XSS — the DOM is manipulated purely client-side.

Reflected XSS is frequently used in phishing and social engineering: attackers craft URLs containing script payloads and trick users into clicking them. When a site echoes attacker input unsafely, the browser executes it as part of the site’s origin.

Key risks:

• Unauthenticated reach — any visitor can be targeted.
• Wide attack surface — a single exploit can affect many sites using the plugin.
• Chaining potential — XSS enables credential theft, CSRF bypass, persistent redirection and malware delivery.

The specifics (what the advisory tells us)

• Vulnerability type: reflected Cross-Site Scripting (XSS).
• Affected versions: plugin ≤ 1.6.0.
• Patched in: 1.6.5.
• Authentication: none required for exploitation.
• CVE: CVE-2024-13362. Published CVSS: 6.1.

Root cause is likely insufficient input validation or improper output encoding when request data is echoed in an HTML/JS context. Vendors commonly avoid publishing exact parameter names or PoC payloads to limit exploit spread; consult the plugin changelog and release notes before testing.

Exploitation scenarios and impact

Attackers can build different chains. Typical scenarios include:

• Phishing/credential theft: fake login overlays or forms to capture credentials.
• Session hijacking: exfiltrate cookies if HttpOnly/Secure flags are missing.
• Affiliate fraud or redirection: redirect visitors to attacker pages.
• Drive-by downloads: cause browsers to fetch malicious payloads.
• Content defacement or injected UI elements.
• Lateral escalation: combined with other weaknesses, XSS can enable higher-impact compromise.

The impact scales with the role of the victim: if an administrator is tricked, the attacker may gain dashboard-level control and install backdoors or modify content.

How to detect if your site is being targeted or exploited

Detection mixes behavioral observation and forensic review. Check:

1. Access logs — search for suspicious query strings (encoded characters like %3C, %3E, %22), presence of tags like
   Review My Order

   0

   Subtotal

   Taxes & shipping calculated at checkout

   Checkout