Stored Cross-Site Scripting Vulnerability in Essential Addons for Elementor Plugin
CVE-2024-3728

6.4MEDIUM

Key Information:

Vendor: Wordpress
Status: Essential Addons For Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders
Vendor: CVE Published:; 2 May 2024

Summary

The Essential Addons for Elementor plugin allows for stored cross-site scripting via its Filterable Gallery and Interactive Circle widgets due to a lack of proper input sanitization and output escaping on user-supplied attributes. Authenticated attackers with contributor-level access or higher can exploit this vulnerability to inject malicious scripts into pages. These scripts execute when a user visits the affected page, potentially compromising user data and site integrity.

Affected Version(s)

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders * <= 5.9.15

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...

https://plugins.trac.wordpress.org/changeset/3075644/esse...

CVSS V3.1

Score:

6.4

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Changed

Timeline

Vulnerability published
May 2, 2024
Vulnerability Reserved
Apr 12, 2024

Credit

Matthew Rollings