Stored Cross-Site Scripting Vulnerability in Gum Elementor Addon Plugin for WordPress

CVE-2024-2348

What is CVE-2024-2348?

The Gum Elementor Addon plugin for WordPress is prone to stored cross-site scripting (XSS) vulnerabilities due to inadequate input sanitization and output escaping in the Post Meta widget. This flaw allows authenticated attackers, possessing subscriber-level access or higher, to inject malicious web scripts into pages. The injected scripts execute automatically when users visit those compromised pages, potentially compromising user data and site integrity.

References