Stored Cross-Site Scripting Vulnerability in Elementor Header & Footer Builder for WordPress

CVE-2024-11230

Summary

The Elementor Header & Footer Builder plugin for WordPress has a vulnerability allowing stored cross-site scripting (XSS) attacks through the 'size' parameter. This security flaw arises from inadequate input validation and output sanitization methods. Authenticated users with Contributor-level access or higher can exploit this vulnerability to inject malicious web scripts into pages. These scripts can execute automatically when users visit pages containing the injected code, potentially compromising user interactions and data. Web administrators are urged to review their plugin versions and apply necessary updates to mitigate these security risks.

References