Lucene search
WordfenceCVELIST:CVE-2024-5088HistoryMay 18, 2024 - 11:35 a.m.
CVE-2024-5088 Happy Addons for Elementor <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
2024-05-1811:35:59
Wordfence
raw.githubusercontent.com
5
cve-2024-5088; wordpress; input sanitization; output escaping; contributor-level access; web scripts; injection
0.001 Low
EPSS
Percentile
20.7%
The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_id’ parameter in all versions up to, and including, 3.10.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
