Stored Cross-Site Scripting in ElementsKit Elementor Addons Plugin for WordPress
CVE-2024-3650

5.4MEDIUM

Key Information:

Vendor
Wordpress
Status
Elementskit Elementor Addons And Templates Library
Vendor
CVE Published:
2 May 2024

Summary

The ElementsKit Elementor addons plugin for WordPress suffers from a stored cross-site scripting vulnerability through its Image Accordion widget. This issue arises from inadequate input sanitization and output escaping, permitting authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. When users access affected pages, these scripts can execute, potentially compromising user data and security. This vulnerability impacts all versions from 3.0.7 to 3.1.2, making it essential for site administrators to apply updates and strengthen their security measures to mitigate potential exploits.

Affected Version(s)

ElementsKit Elementor addons and Templates Library 3.0.7 <= 3.1.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3078160/elem...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

wesley
.