CVE-2024-8236 Elementor Website Builder – More than Just a Page Builder <= 3.25.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

🗓️ 26 Nov 2024 13:56:54Reported by WordfenceType

Elementor Website Builder plugin for WordPress, versions up to 3.25.7, allows Contributor+ level authenticated attackers to execute Stored Cross-Site Scripting via the 'url' parameter of the Icon widget due to insufficient input sanitization

Reporter	Title	Published	Views	Family All 10
CNNVD	WordPress plugin Elementor Website Builder 跨站脚本漏洞	26 Nov 202400:00	–	cnnvd
CVE	CVE-2024-8236	26 Nov 202413:56	–	cve
EUVD	EUVD-2024-49535	3 Oct 202520:07	–	euvd
NVD	CVE-2024-8236	26 Nov 202414:15	–	nvd
Patchstack	WordPress Elementor Website Builder Plugin <= 3.25.7 is vulnerable to Cross Site Scripting (XSS)	26 Nov 202400:00	–	patchstack
Patchstack	WordPress Elementor Website Builder – More than Just a Page Builder plugin <= 3.25.7 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability	26 Nov 202407:24	–	patchstack
Positive Technologies	PT-2024-38884 · WordPress · Elementor Website Builder	26 Nov 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-8236	23 May 202507:19	–	redhatcve
Vulnrichment	CVE-2024-8236 Elementor Website Builder – More than Just a Page Builder <= 3.25.7 - Authenticated (Contributor+) Stored Cross-Site Scripting	26 Nov 202413:56	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (November 25, 2024 to December 1, 2024)	5 Dec 202415:44	–	wordfence

[
  {
    "vendor": "elemntor",
    "product": "Elementor Website Builder – more than just a page builder",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "3.25.7",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/b1305be5-8267-475f-b962-62e3930116e1
plugins	www.plugins.trac.wordpress.org/changeset/3192020/
plugins	www.plugins.trac.wordpress.org/browser/elementor/tags/3.23.4/includes/widgets/icon.php

08 Apr 2026 17:16Current

CVSS 3.16.4

EPSS0.00212

CWE-79