Stored Cross-Site Scripting Vulnerability Affects Elementor Website Builder
CVE-2024-8236
6.4MEDIUM
Key Information:
- Vendor
- Wordpress
- Vendor
- CVE Published:
- 26 November 2024
Summary
The Elementor Website Builder plugin for WordPress has a vulnerability that could allow authenticated attackers, with Contributor-level access and above, to perform Stored Cross-Site Scripting (XSS) attacks. This weakness arises from insufficient input sanitization and output escaping related to the 'url' parameter in the Icon widget. As a result, malicious scripts can be injected into pages, executing whenever a user accesses the compromised page. Users are advised to review their plugin versions and apply necessary updates to mitigate risks associated with this vulnerability.
Affected Version(s)
Elementor Website Builder – More than Just a Page Builder * <= 3.25.7
References
CVSS V3.1
Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved
Credit
wesley