Stored Cross-Site Scripting Vulnerability in Elementor Addon Elements Plugin by WordPress

CVE-2024-1422

What is CVE-2024-1422?

The Elementor Addon Elements plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability. This issue arises from inadequate input sanitization and output escaping on user-defined attributes within the modal popup widget's effect setting. Authenticated attackers with contributor-level permissions and above can exploit this flaw, allowing them to inject arbitrary scripts into web pages. When users visit an affected page, these scripts will be executed, potentially compromising user security and data integrity.

References