Stored Cross-Site Scripting Vulnerability in Card Elements for Elementor Plugin by WordPress

CVE-2024-13734

What is CVE-2024-13734?

The Card Elements for Elementor plugin for WordPress is prone to a Stored Cross-Site Scripting vulnerability through its Profile Card widget. This issue arises from inadequate input sanitization and output escaping on user-supplied attributes. Authenticated attackers with contributor-level access and higher can exploit this vulnerability to inject malicious scripts into pages, facilitating script execution whenever users visit the compromised page.

References