Stored Cross-Site Scripting Vulnerability in Exclusive Addons for Elementor Plugin

CVE-2024-0824

What is CVE-2024-0824?

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting through its Link Anything feature. All versions up to and including 2.6.8 lack adequate input sanitization and output escaping, allowing authenticated attackers with contributor-level access or higher to inject malicious web scripts. These scripts are executed whenever users access crafted pages, potentially compromising user data and integrity.

References