Stored Cross-Site Scripting Vulnerability in Happy Addons for Elementor Plugin

CVE-2024-2788

Summary

The Happy Addons for Elementor plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and lack of proper output escaping of user-supplied attributes in the Post Title HTML Tag. This vulnerability allows authenticated attackers, who have contributor-level access or higher, to inject arbitrary web scripts into pages. Consequently, these scripts execute whenever a user navigates to the compromised page, potentially leading to unauthorized actions and data exposure.

References