Stored Cross-Site Scripting Vulnerability in Elementor Website Builder Plugin
CVE-2024-13445
5.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 20 February 2025
What is CVE-2024-13445?
The Elementor Website Builder plugin for WordPress is susceptible to a stored cross-site scripting vulnerability due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts through the border, margin, and gap parameters. These scripts execute whenever a user visits a page that has been compromised, posing significant risks to users and website integrity.
Affected Version(s)
Elementor Website Builder – More Than Just a Page Builder * <= 3.27.4