Stored Cross-Site Scripting Vulnerability in Xpro Addons for Elementor by WordPress

CVE-2024-13649

What is CVE-2024-13649?

The Xpro Addons for Elementor plugin allows authenticated users with Contributor-level access or higher to exploit a vulnerability through stored cross-site scripting (XSS). This occurs due to insufficient input sanitization and output escaping in various widgets, enabling attackers to inject malicious scripts that execute when users access the compromised pages. Immediate attention is required to ensure the security of WordPress installations using this plugin.

References