CVE-2024-5611

🗓️ 15 Jun 2024 09:43:51Reported by WordfenceType

The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'label_years' attribute within the Countdown widget in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2024-5611	15 Jun 202410:15	–	attackerkb
CNNVD	WordPress plugin Stratum - Elementor Widgets Security Vulnerability	15 Jun 202400:00	–	cnnvd
Cvelist	CVE-2024-5611 Stratum – Elementor Widgets <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget	15 Jun 202409:43	–	cvelist
EUVD	EUVD-2024-46794	3 Oct 202520:07	–	euvd
NVD	CVE-2024-5611	15 Jun 202410:15	–	nvd
Patchstack	WordPress Stratum Plugin <= 1.4.1 is vulnerable to Cross Site Scripting (XSS)	14 Jun 202400:00	–	patchstack
Patchstack	WordPress Stratum – Elementor Widgets plugin <= 1.4.1 - Authenticated Stored Cross-Site Scripting via Countdown Widget vulnerability	14 Jun 202412:46	–	patchstack
RedhatCVE	CVE-2024-5611	23 May 202508:29	–	redhatcve
Vulnrichment	CVE-2024-5611 Stratum – Elementor Widgets <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget	15 Jun 202409:43	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (June 10, 2024 to June 16, 2024)	20 Jun 202413:40	–	wordfence

Vulners

Node

jetmonsters stratum_widgets_for_elementorRange≤1.4.1wordpress

[
  {
    "vendor": "jetmonsters",
    "product": "Stratum Widgets for Elementor",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.4.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/stratum/tags/1.4.0/includes/templates/countdown.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/840dd4a9-103a-4ff9-ba26-3bf5b6e831a1
plugins	www.plugins.trac.wordpress.org/changeset/3102765

15 Apr 2026 00:35Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.16.4

EPSS0.00233

SSVC

CWE-79