Stored Cross-Site Scripting Vulnerability in Elementor Site Library Plugin
CVE-2024-8921

6.4MEDIUM

Key Information:

Vendor

Wordpress
Vendor
CVE Published:
16 October 2024

What is CVE-2024-8921?

The Zita Elementor Site Library plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability, enabling authenticated users with Author-level and higher access to upload SVG files that aren't properly sanitized. This oversight allows attackers to inject arbitrary web scripts into web pages, which will execute for any user viewing the SVG file. Immediate action is recommended for all users employing the Zita Elementor Site Library to mitigate potential security risks associated with this vulnerability.

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/zita-site-libr...
https://plugins.trac.wordpress.org/browser/zita-site-libr...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

.
CVE-2024-8921 : Stored Cross-Site Scripting Vulnerability in Elementor Site Library Plugin