Stored Cross-Site Scripting in Element Pack Elementor Addons for WordPress

CVE-2024-3926

What is CVE-2024-3926?

The Element Pack Elementor Addons for WordPress contains a vulnerability that allows authenticated users with contributor-level access and higher to perform Stored Cross-Site Scripting (XSS) attacks. The vulnerability arises due to insufficient input sanitization and output escaping on user-supplied attributes in widgets like Header Footer, Template Library, and more. If exploited, an attacker could inject malicious scripts that execute when a page is accessed by other users, potentially compromising user data and site integrity.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References