Stored Cross-Site Scripting in Exclusive Addons for Elementor Plugin by WordPress

CVE-2024-1414

What is CVE-2024-1414?

The Exclusive Addons for Elementor plugin for WordPress is susceptible to Stored Cross-Site Scripting attacks through the Call To Action widget. This vulnerability arises due to inadequate input sanitization and output escaping, allowing authenticated attackers with a contributor-level role or higher to inject malicious scripts. These scripts may execute when users access pages that have been compromised, potentially leading to unauthorized actions or data disclosure.

References