Stored Cross-Site Scripting in ElementsKit Elementor Addons Plugin for WordPress
CVE-2024-8546

5.4MEDIUM

Key Information:

Vendor

Wordpress
Status
Elementskit Elementor Addons
Vendor
CVE Published:
25 September 2024

What is CVE-2024-8546?

The ElementsKit Elementor addons plugin for WordPress is subjected to a vulnerability that allows for Stored Cross-Site Scripting through its Video widget. This issue exists in all versions of the plugin from launch to and including version 3.2.7, primarily due to inadequate input sanitization and output escaping mechanisms on attributes provided by users. Authenticated attackers, particularly those with contributor-level access and above, can exploit this vulnerability by injecting arbitrary web scripts within pages. When users access these pages, the malicious scripts are executed, potentially compromising the security and integrity of the site.

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wordpress.org/plugins/elementskit-lite/#developers
https://plugins.trac.wordpress.org/browser/elementskit-li...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.