Stored Cross-Site Scripting in HT Mega – Absolute Addons For Elementor Plugin

CVE-2024-3308

Summary

The HT Mega – Absolute Addons For Elementor plugin for WordPress contains a vulnerability that allows for Stored Cross-Site Scripting (XSS) attacks. This issue arises from inadequate input sanitization and output escaping in the Image Grid widget's attributes. Authenticated attackers with contributor access or higher can exploit this vulnerability to inject malicious scripts into pages, which will execute when other users access the compromised pages. This poses significant risks to user data integrity and application security.

References