Elementor Plugin Vulnerable to Stored Cross-Site Scripting
CVE-2024-2623
6.4MEDIUM
Key Information:
- Vendor
Wordpress
- Status
- Vendor
- CVE Published:
- 9 April 2024
What is CVE-2024-2623?
The Essential Addons for Elementor plugin for WordPress is prone to a Stored Cross-Site Scripting vulnerability through the countdown widget's message parameter, affecting all versions up to and including 5.9.11. This vulnerability arises from inadequate input sanitization and output escaping, allowing authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. Such scripts can execute whenever a user accesses a compromised page, potentially leading to unauthorized actions or data exposure.
Affected Version(s)
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders * <= 5.9.11