Stored Cross-Site Scripting Vulnerability in Essential Addons for Elementor Plugin
CVE-2024-3728
6.4MEDIUM
Key Information:
- Vendor
Wordpress
- Status
- Vendor
- CVE Published:
- 2 May 2024
What is CVE-2024-3728?
The Essential Addons for Elementor plugin allows for stored cross-site scripting via its Filterable Gallery and Interactive Circle widgets due to a lack of proper input sanitization and output escaping on user-supplied attributes. Authenticated attackers with contributor-level access or higher can exploit this vulnerability to inject malicious scripts into pages. These scripts execute when a user visits the affected page, potentially compromising user data and site integrity.
Affected Version(s)
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders * <= 5.9.15