Image Hover Effects - Elementor Addon < 1.3.4 - Contributor+ Stored XSS

The “Image Hover Effects – Elementor Addon” WordPress Plugin before 1.3.4 has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method. The “Image Hover Effects” widget accepts a “eihe_tag” parameter. Although the element control lists a fixed set of possible html tags, it is possible to send a ‘save_builder’ request with “eihe_tag” set to JavaScript. Alternatively, it is possible to set “eihe_tag” to simply “script” and add the JavaScript to be executed in the actual title. This JavaScript will then be executed when the saved page is viewed or previewed. This vulnerability is nearly identical to the vulnerabilities we have recently disclosed in the main Elementor plugin: https://www.wordfence.com/blog/2021/03/cross-site-scripting-vulnerabilities-in-elementor-impact-over-7-million-sites/