Stored Cross-Site Scripting Vulnerability Affects Elementor Website Builder

CVE-2024-8236

What is CVE-2024-8236?

The Elementor Website Builder plugin for WordPress has a vulnerability that could allow authenticated attackers, with Contributor-level access and above, to perform Stored Cross-Site Scripting (XSS) attacks. This weakness arises from insufficient input sanitization and output escaping related to the 'url' parameter in the Icon widget. As a result, malicious scripts can be injected into pages, executing whenever a user accesses the compromised page. Users are advised to review their plugin versions and apply necessary updates to mitigate risks associated with this vulnerability.

References