Stored Cross-Site Scripting Vulnerability in Royal Elementor Addons and Templates for WordPress

CVE-2024-0442

What is CVE-2024-0442?

The Royal Elementor Addons and Templates plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) due to inadequate input sanitization and output escaping. This vulnerability affects all versions up to 1.3.87 and allows authenticated attackers with contributor access or higher to inject malicious scripts through element URL parameters. Consequently, these scripts will execute every time a user accesses a page that has been compromised, exposing visitors to potential data theft or site hijacking.

References