Stored Cross-Site Scripting in Essential Addons for Elementor

CVE-2024-2650

Summary

The Essential Addons for Elementor plugin, widely used for creating custom templates and enhancing WooCommerce functionality within WordPress, is susceptible to Stored Cross-Site Scripting. This vulnerability arises from inadequate sanitization of user inputs via the alignment parameter in the Woo Product Carousel widget. As a result, authenticated users with contributor-level access or higher can insert malicious scripts into web pages, leading to potential exploitation when other users visit the affected pages. This situation emphasizes the necessity for stringent input validation and output escaping to safeguard against such vulnerabilities.

References