Stored Cross-Site Scripting Vulnerability in Unlimited Elements For Elementor Plugin

CVE-2024-13153

Summary

The Unlimited Elements For Elementor plugin for WordPress contains a vulnerability that allows authenticated users with contributor-level access or higher to execute arbitrary web scripts through stored cross-site scripting. This occurs due to inadequate input sanitization and output escaping on user-supplied attributes across multiple widgets. Affected widgets like Image Tooltip, Notification, Simple Popup, Video Play Button, and Card Carousel must be properly managed—deleted and reinstalled manually—to apply the necessary patch.

References