Stored Cross-Site Scripting Vulnerability in Elementor Plugin

CVE-2024-9888

What is CVE-2024-9888?

The ElementInvader Addons for Elementor plugin for WordPress presents a Stored Cross-Site Scripting vulnerability that arises from inadequate input sanitization and output escaping on user-supplied attributes, particularly within the plugin's contact form widget redirect URL. This flaw enables authenticated users with a contributor-level access or higher to insert arbitrary web scripts into pages. Such scripts execute whenever a user accesses these modified pages, potentially leading to unauthorized actions and breaches of user data security. Mitigation strategies include ensuring proper input validation and output encoding to prevent script injection.

References