Stored Cross-Site Scripting Vulnerability in Royal Elementor Addons for WordPress

CVE-2024-3675

Summary

The Royal Elementor Addons and Templates plugin for WordPress is susceptible to a stored cross-site scripting vulnerability. This issue arises from inadequate input sanitization and output escaping on user-supplied attributes within the plugin's Flip Carousel, Flip Box, Post Grid, and Taxonomy List widgets. Authenticated users with contributor-level access or higher can exploit this vulnerability to inject arbitrary web scripts into pages. These scripts will execute when users access the compromised pages, posing serious security risks to site visitors and data integrity.

References