Stored Cross-Site Scripting Vulnerability in Plus Addons for Elementor
CVE-2024-3199

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
The Plus Addons For Elementor – Addons For Elementor, Page Templates, Widgets, Mega Menu, WooCommerce
Vendor
CVE Published:
2 May 2024

What is CVE-2024-3199?

The Plus Addons for Elementor plugin for WordPress is exposed to a stored cross-site scripting vulnerability through its countdown widget. This vulnerability exists due to insufficient input sanitization and output escaping, allowing authenticated users with contributor access or higher to inject arbitrary web scripts. These malicious scripts can execute whenever a user accesses the affected page, posing significant security risks and impacting user data integrity across websites utilizing the vulnerable versions of the plugin.

Affected Version(s)

The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce 0 <= 5.4.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/the-plus-addon...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Craig Smith
.