Stored Cross-Site Scripting in ElementsKit Elementor Addons Plugin for WordPress

CVE-2024-3650

What is CVE-2024-3650?

The ElementsKit Elementor addons plugin for WordPress suffers from a stored cross-site scripting vulnerability through its Image Accordion widget. This issue arises from inadequate input sanitization and output escaping, permitting authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. When users access affected pages, these scripts can execute, potentially compromising user data and security. This vulnerability impacts all versions from 3.0.7 to 3.1.2, making it essential for site administrators to apply updates and strengthen their security measures to mitigate potential exploits.

References