CVE-2024-5177 Hash Elements <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter in Multiple Widgets

The Hash Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter within multiple widgets in all versions up to, and including, 1.3.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-5177

CVE-2024-5177 — Hash Elements (WordPress) : A stored XSS vulnerability via the url parameter in multiple widgets affects all versions up to 1.3.8. Exploitation requires authenticated access (contributor+). Wordfence notes the patch status as Patched; remediation is to apply the update where avail...

WordPress Hash Elements Plugin <= 1.3.8 is vulnerable to Cross Site Scripting (XSS)

Software Hash Elements Type Plugin Vulnerable versions = 1.3.8 Fixed in 1.3.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5177 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 3175f5a96af0 Credits stealthcopter Required...