CVE-2024-0834

🗓️ 05 Feb 2024 21:21:47Reported by WordfenceType

The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the link_to parameter in all versions up to, and including, 1.12.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2024-0834	29 Feb 202412:26	–	circl
CNNVD	WordPress plugin Elementor Addon Elements security vulnerability	5 Feb 202400:00	–	cnnvd
Cvelist	CVE-2024-0834	5 Feb 202421:21	–	cvelist
EUVD	EUVD-2024-16617	3 Oct 202520:07	–	euvd
NVD	CVE-2024-0834	5 Feb 202422:16	–	nvd
OpenVAS	WordPress Elementor Addon Elements Plugin < 1.12.12 XSS Vulnerability	19 Feb 202500:00	–	openvas
OSV	CVE-2024-0834	5 Feb 202422:16	–	osv
Patchstack	WordPress Elementor Addon Elements Plugin <= 1.12.11 is vulnerable to Cross Site Scripting (XSS)	6 Feb 202400:00	–	patchstack
Prion	Cross site scripting	5 Feb 202422:16	–	prion
RedhatCVE	CVE-2024-0834	23 May 202507:26	–	redhatcve

NVD

Vulners

Node

webtechstreet elementor_addon_elementsRange≤1.12.11wordpress

[
  {
    "vendor": "webtechstreet",
    "product": "Elementor Addon Elements",
    "versions": [
      {
        "version": "1.12.11",
        "status": "affected"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/6ebb5654-ba3e-4f18-8720-a6595a771964
plugins	www.plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/trunk/modules/price-table/widgets/price-table.php
plugins	www.plugins.trac.wordpress.org/changeset

21 Nov 2024 08:47Current

5.6Medium risk

Vulners AI Score5.6

CVSS 3.15.4 - 6.4

EPSS0.00531

SSVC

CWE-79