PT-2024-25577 · Eleblog · Eleblog

Name of the Vulnerable Software and Affected Versions: Eleblog – Elementor Blog And Magazine Addons versions 1.8 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks...

WordPress The Plus Addons for Elementor Page Builder Lite Plugin <= 5.4.2 is vulnerable to Cross Site Scripting (XSS)

Software The Plus Addons for Elementor Page Builder Lite Type Plugin Vulnerable versions = 5.4.2 Fixed in 5.5.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34373 Patch priority Low CVSS severity Low 6.5 Developer POSIMYTH Innovations PSID e2e02d7c4287 Credits...

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders < 5.9.18 - Contributor+ Stored XSS

Description The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders is vulnerable to Stored Cross-Site Scripting via the ‘eaeleventtextcolor’ parameter...

Jeg Elementor Kit < 2.6.5 - Contributor+ Stored XSS via Countdown Widget

Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin...

WordPress Elementor Pro Plugin <= 3.21.0 is vulnerable to Cross Site Scripting (XSS)

Software Elementor Pro Type Plugin Vulnerable versions = 3.21.0 Fixed in 3.21.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4107 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 5e068ca3d9a8 Credits wesley wcraft Required...

WordPress Contact Form & Lead Form Elementor Builder Plugin <= 1.8.9 is vulnerable to Cross Site Scripting (XSS)

Software Contact Form & Lead Form Elementor Builder Type Plugin Vulnerable versions = 1.8.9 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3637 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID c8bf001e4e07 Credits...

Premium Addons for Elementor < 4.10.26 - Contributor+ Stored XSS

Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin...

ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) < 2.8.8 - Contributor+ Stored XSS

Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin...

WordPress LA-Studio Element Kit for Elementor Plugin <= 1.3.7.5 is vulnerable to Cross Site Scripting (XSS)

Software LA-Studio Element Kit for Elementor Type Plugin Vulnerable versions = 1.3.7.5 Fixed in 1.3.7.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3005 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 48cb803bd0d8 Credits...

Royal Elementor Addons < 1.3.95 - Unauthenticated IP Spoofing

Description The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to IP Address Spoofing due to insufficient IP address validation. This makes it possible for unauthenticated attackers to spoof their IP addresses. Set any of the following server headers as used in getclienti...

WordPress Sina Extension for Elementor Plugin <= 3.5.1 is vulnerable to Local File Inclusion

Software Sina Extension for Elementor Type Plugin Vulnerable versions = 3.5.1 Fixed in 3.5.2 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-34384 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 5b7bd9ab6963 Credits Ray Wilson Required privilege...

WordPress ElementsReady Addons for Elementor Plugin <= 5.8.0 is vulnerable to Cross Site Scripting (XSS)

Software ElementsReady Addons for Elementor Type Plugin Vulnerable versions = 5.8.0 Fixed in 5.9.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34374 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID d0609fd52224 Credits Khalid Yusuf Requir...

CVE-2024-4265

The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in versions up to, and including, 2.0.5.9 due to insufficient input sanitization and output escaping. This makes ...

CVE-2024-4156

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eaeleventtextcolor’ parameter in versions up to, and including, 5.9.17 due to insufficient input sanitization and output...

CVE-2024-3985

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Call to Action widget in all versions up to, and including, 2.6.9.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

CVE-2024-4003

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the eaelteammembersimagerounded parameter in the Team Members widget in all versions up to, and including, 5.9.15 due to...

CVE-2024-3991

The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution formerly WooLentor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the id attribute in the Horizontal Product Filter in all versions up to, and including, 2.8.7 due to insufficie...

CVE-2024-3891

The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML tags in widgets in all versions up to, and including, 3.10.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-3885

The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the subcontainer value parameter in all versions up to, and including, 4.10.28 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...

CVE-2024-3819

The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's JKit - Banner widget in all versions up to, and including, 2.6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...