Stored Cross-Site Scripting in Master Addons for Elementor Plugin by WordPress
CVE-2024-4265
5.4MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 2 May 2024
What is CVE-2024-4265?
The Master Addons plugin for Elementor is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping on the ‘url’ parameter. Authenticated attackers with contributor-level permissions can exploit this vulnerability to inject malicious scripts into web pages. These scripts will execute in the context of other users accessing affected pages, potentially leading to unauthorized actions, data theft, or other security complications.
Affected Version(s)
Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor * <= 2.0.5.9