Stored Cross-Site Scripting Vulnerability in Xpro Addons for Elementor by WordPress

CVE-2024-13649

What is CVE-2024-13649?

The Xpro Addons for Elementor plugin allows authenticated users with Contributor-level access or higher to exploit a vulnerability through stored cross-site scripting (XSS). This occurs due to insufficient input sanitization and output escaping in various widgets, enabling attackers to inject malicious scripts that execute when users access the compromised pages. Immediate attention is required to ensure the security of WordPress installations using this plugin.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References