Stored Cross-Site Scripting in HT Mega – Absolute Addons For Elementor Plugin

CVE-2024-12597

What is CVE-2024-12597?

The HT Mega – Absolute Addons For Elementor plugin for WordPress is affected by a Stored Cross-Site Scripting vulnerability allowing authenticated attackers with Contributor-level access or higher to exploit insufficient input sanitization and output escaping. By manipulating the 'block_css' and 'inner_css' parameters, attackers can inject arbitrary web scripts that will execute whenever users access the compromised pages, posing serious security risks to site visitors.

References