CVE-2021-24258 ElementsKit and ElementsKit Pro < 2.2.0 - Contributor+ Stored XSS

2021-05-0518:28:46

CWE-79

WPScan

www.cve.org

elementskit

elementskit pro

wordpress plugins

cross-site scripting

xss

vulnerability

cve-2021-24258

EPSS

0.001

Percentile

19.4%

JSON

The Elements Kit Lite and Elements Kit Pro WordPress Plugins before 2.2.0 have a number of widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.

CNA Affected

[
  {
    "product": "Elements Kit Lite",
    "vendor": "Wpmet",
    "versions": [
      {
        "lessThan": "2.2.0",
        "status": "affected",
        "version": "2.2.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Elements Kit Pro",
    "vendor": "Wpmet",
    "versions": [
      {
        "lessThan": "2.2.0",
        "status": "affected",
        "version": "2.2.0",
        "versionType": "custom"
      }
    ]
  }
]