Stored Cross-Site Scripting Vulnerability in Royal Elementor Addons for WordPress

CVE-2024-12120

What is CVE-2024-12120?

The Royal Elementor Addons and Templates plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability. This issue arises from the inadequacy of input sanitization and output escaping on the Countdown widget's display_message_text parameter. Authenticated attackers, who have Contributor-level access and above, can exploit this flaw to inject arbitrary scripts into pages. These scripts will execute whenever users visit the compromised pages, posing significant risks to user data and website integrity. It's crucial for users of the plugin to update to the latest version to mitigate this vulnerability.

References