Stored Cross-Site Scripting Vulnerability in Essential Addons for Elementor Plugin

CVE-2024-9993

What is CVE-2024-9993?

The Essential Addons for Elementor plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability through the eael_event_details_text parameter of the Event Calendar Widget. This flaw arises from inadequate input sanitization and output escaping on attributes supplied by users. As a result, authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages, which will execute when users visit those compromised pages. This education underscores the importance of proper code validation and user input sanitization within plugins.

References