Stored Cross-Site Scripting Vulnerability Affects Themesflat Addons For Elementor Plugin

CVE-2024-8515

Summary

The Themesflat Addons For Elementor plugin for WordPress exhibits a vulnerability that enables Stored Cross-Site Scripting through various widgets such as 'TF E Slider Widget', 'TF Video Widget', and 'TF Team Widget'. This vulnerability arises from inadequate input sanitization and output escaping on URL attributes found within the plugin. Authenticated attackers with Contributor-level access can exploit this security flaw to inject arbitrary web scripts into pages, which will execute whenever a user accesses a compromised page. This presents potential risks for users by exposing them to malicious scripts integrated into the content.

References