Stored Cross-Site Scripting Vulnerability in Unlimited Elements for Elementor Plugin

CVE-2024-13155

What is CVE-2024-13155?

The Unlimited Elements for Elementor plugin in WordPress is affected by a Stored Cross-Site Scripting vulnerability due to improper input sanitization and output escaping in the Transparent Split Hero widget. Authenticated users, including those with contributor permissions or higher, may exploit this flaw to inject and execute malicious web scripts on pages viewed by other users. To mitigate this risk, users must manually delete and reinstall the affected widget, as the widget's code is not integrated into the main codebase.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References