Stored Cross-Site Scripting Vulnerability Affects Elementor Website Builder

CVE-2024-8236

What is CVE-2024-8236?

The Elementor Website Builder plugin for WordPress has a vulnerability that could allow authenticated attackers, with Contributor-level access and above, to perform Stored Cross-Site Scripting (XSS) attacks. This weakness arises from insufficient input sanitization and output escaping related to the 'url' parameter in the Icon widget. As a result, malicious scripts can be injected into pages, executing whenever a user accesses the compromised page. Users are advised to review their plugin versions and apply necessary updates to mitigate risks associated with this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References