Cross-site Scripting Vulnerability in WPBITS Addons for Elementor Page Builder
CVE-2024-37945

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
WPbits Addons For Elementor Page Builder
Vendor
CVE Published:
14 August 2025

What is CVE-2024-37945?

A Cross-site Scripting (XSS) vulnerability exists in the WPBITS Addons for Elementor Page Builder that allows attackers to inject malicious scripts into web pages. This vulnerability affects all versions of the plugin up to 1.5, enabling stored XSS attacks which could compromise user data and safety. Web developers using this plugin need to take immediate action to mitigate potential risks by updating to a secured version.

Affected Version(s)

WPBITS Addons For Elementor Page Builder <= 1.5

References

https://patchstack.com/database/wordpress/plugin/wpbits-a...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michael (Patchstack Bug Bounty program)
.