Stored Cross-Site Scripting in ElementsKit Elementor Addons Plugin for WordPress

CVE-2024-8546

Summary

The ElementsKit Elementor addons plugin for WordPress is subjected to a vulnerability that allows for Stored Cross-Site Scripting through its Video widget. This issue exists in all versions of the plugin from launch to and including version 3.2.7, primarily due to inadequate input sanitization and output escaping mechanisms on attributes provided by users. Authenticated attackers, particularly those with contributor-level access and above, can exploit this vulnerability by injecting arbitrary web scripts within pages. When users access these pages, the malicious scripts are executed, potentially compromising the security and integrity of the site.

References