Stored Cross-Site Scripting Vulnerability in Stratum Elementor Widgets Plugin by WordPress

CVE-2024-13642

What is CVE-2024-13642?

The Stratum – Elementor Widgets plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to inadequate input sanitization and output escaping for user-supplied attributes in the Image Hotspot widget. This flaw allows authenticated attackers with contributor-level access or higher to embed malicious web scripts within pages. These scripts execute when users visit the compromised page, potentially leading to unauthorized actions or data exposure.

References