Stored Cross-Site Scripting Vulnerability in Elementor Website Builder for WordPress

CVE-2024-10453

Summary

CVE-2024-10453 identifies a critical stored cross-site scripting (XSS) vulnerability in the Elementor Website Builder plugin for WordPress. This flaw arises from inadequate input sanitization and output escaping in the plugin's Typography Settings, affecting all versions up to and including 3.25.9. Authenticated attackers with contributor-level access or higher can exploit this vulnerability to inject malicious scripts into pages, which will execute whenever a victim accesses those compromised pages. Proper sanitization and escaping are crucial to mitigate such vulnerabilities in web applications, particularly those accessible to a wide range of contributors.

References