Stored Cross-Site Scripting Vulnerability in Premium Addons for Elementor by WordPress

CVE-2024-11937

What is CVE-2024-11937?

The Premium Addons for Elementor plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping on user-supplied attributes. This vulnerability allows authenticated attackers, possessing contributor-level access and above, to inject malicious web scripts into web pages. The injected scripts execute whenever a user accesses the compromised page, posing serious security risks to affected websites and their users. To mitigate this issue, it is crucial to update to the latest version of the plugin that addresses these vulnerabilities.

References