Stored Cross-Site Scripting in Happy Addons for Elementor Plugin for WordPress
CVE-2024-0438
5.4MEDIUM
Key Information:
- Vendor
- Wordpress
- Vendor
- CVE Published:
- 29 February 2024
Summary
The Happy Addons for Elementor plugin for WordPress has a vulnerability that allows for Stored Cross-Site Scripting through the 'wrapper link' parameter in the Age Gate feature. This vulnerability arises from inadequate input sanitization and output escaping mechanisms. Authenticated attackers with contributor access or higher may exploit this flaw to inject malicious scripts into pages. As a result, any user accessing those compromised pages could unwittingly execute these scripts, posing significant security risks to the site's integrity and user data.
Affected Version(s)
Happy Addons for Elementor * <= 3.10.1
References
CVSS V3.1
Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved
Credit
wesley