The Plus Addons for Elementor < 5.3.4 - Contributor+ Stored XSS

2024-02-0200:00:00

wpscan.com

stored xss

elementor

vulnerability

input sanitization

output escaping

authenticated attackers

contributor-level access

6 Medium

AI Score

Confidence

High

0 Low

EPSS

Percentile

0.0%

JSON

Description The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, allowing authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CPENameOperatorVersion
eq5.3.4

CPE	Name	Operator	Version
		eq	5.3.4

References

patchstack.com/database/vulnerability/the-plus-addons-for-elementor-page-builder/wordpress-the-plus-addons-for-elementor-plugin-5-3-3-cross-site-scripting-xss-vulnerability