CVE-2021-24270

The “DeTheme Kit for Elementor” WordPress Plugin before 1.5.5.5 has a widget that is vulnerable to stored Cross-Site Scripting XSS by lower-privileged users such as contributors, all via a similar method...

CVE-2021-24270 DethemeKit For Elementor < 1.5.5.5 - Contributor+ Stored XSS

The “DeTheme Kit for Elementor” WordPress Plugin before 1.5.5.5 has a widget that is vulnerable to stored Cross-Site Scripting XSS by lower-privileged users such as contributors, all via a similar method...

CVE-2021-24270

The CVE-2021-24270 entry concerns the DeTheme Kit for Elementor WordPress plugin prior to version 1.5.5.5, where a widget (De Page/Post Title) accepts an html_tag parameter. A stored XSS exists due to unsanitized JavaScript in this parameter, exploitable by low-privilege users (e.g., contributors...