Stored Cross-Site Scripting Vulnerability in Unlimited Elements for Elementor Plugin

CVE-2024-13155

Summary

The Unlimited Elements for Elementor plugin in WordPress is affected by a Stored Cross-Site Scripting vulnerability due to improper input sanitization and output escaping in the Transparent Split Hero widget. Authenticated users, including those with contributor permissions or higher, may exploit this flaw to inject and execute malicious web scripts on pages viewed by other users. To mitigate this risk, users must manually delete and reinstall the affected widget, as the widget's code is not integrated into the main codebase.

References