Stored XSS Vulnerability in Elementor Addons

CVE-2024-10310

Summary

The Element Pack Elementor Addons plugin for WordPress contains a Stored Cross-Site Scripting vulnerability due to inadequate sanitization of user input in its Custom Gallery Widget. Specifically, the 'image_title' parameter lacks proper input validation and output escaping, allowing authenticated attackers with Contributor-level access or greater to inject malicious scripts. These scripts will execute when users access affected pages, potentially compromising site security and user data. It is crucial for users of this plugin to apply security best practices and update to the latest version to mitigate risks.

References