CVE-2024-2129 WPBITS Addons For Elementor Page Builder <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

🗓️ 20 Mar 2024 06:48:23Reported by WordfenceType

Wordpress plugin vulnerable to Stored Cross-Site Scripting via heading widget. Allows authenticated attackers to inject arbitrary web scripts.

Reporter	Title	Published	Views	Family All 10
CNNVD	WordPress Plugin WPBITS Addons For Elementor Page Builder Security Vulnerability	20 Mar 202400:00	–	cnnvd
CVE	CVE-2024-2129	20 Mar 202406:48	–	cve
EUVD	EUVD-2024-27093	3 Oct 202520:07	–	euvd
NVD	CVE-2024-2129	20 Mar 202407:15	–	nvd
Patchstack	WordPress WPBITS Addons For Elementor Page Builder plugin <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability	2 Feb 202619:40	–	patchstack
Positive Technologies	PT-2024-18851 · WordPress · Wpbits Addons For Elementor Page Builder	20 Mar 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-2129	7 Jan 202609:14	–	redhatcve
Vulnrichment	CVE-2024-2129 WPBITS Addons For Elementor Page Builder <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting	20 Mar 202406:48	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (March 18, 2024 to March 24, 2024)	28 Mar 202415:35	–	wordfence
WPVulnDB	WPBITS Addons For Elementor Page Builder <= 1.3.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	19 Mar 202400:00	–	wpvulndb

[
  {
    "vendor": "wpbits",
    "product": "WPBITS Addons For Elementor Page Builder",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.4",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordpress	www.wordpress.org/plugins/wpbits-addons-for-elementor/
plugins	www.plugins.trac.wordpress.org/changeset
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/05cd8f96-533a-4036-a01f-6ba1ad2d2b5e

08 Apr 2026 16:33Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.16.4

EPSS0.00278

CWE-79