Stored Cross-Site Scripting in Happy Addons for Elementor Plugin for WordPress
CVE-2024-0438

5.4MEDIUM

Key Information:

Vendor
Wordpress
Vendor
CVE Published:
29 February 2024

Summary

The Happy Addons for Elementor plugin for WordPress has a vulnerability that allows for Stored Cross-Site Scripting through the 'wrapper link' parameter in the Age Gate feature. This vulnerability arises from inadequate input sanitization and output escaping mechanisms. Authenticated attackers with contributor access or higher may exploit this flaw to inject malicious scripts into pages. As a result, any user accessing those compromised pages could unwittingly execute these scripts, posing significant security risks to the site's integrity and user data.

Affected Version(s)

Happy Addons for Elementor * <= 3.10.1

References

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

wesley
.