Stored Cross-Site Scripting Vulnerability in Happy Addons for Elementor Plugin
CVE-2024-2786
5.4MEDIUM
Summary
The Happy Addons for Elementor plugin for WordPress includes a vulnerability that allows authenticated attackers with contributor-level access to exploit insufficient input sanitization and output escaping in the title_tag attribute across several widgets. This could enable the injection of arbitrary web scripts that execute when users access compromised pages, posing significant risks to website integrity and user trust.
Affected Version(s)
Happy Addons for Elementor * <= 3.10.4
References
CVSS V3.1
Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved
Credit
wesley