Lucene search

K
wpvulndbWpvulndbWPVDB-ID:D6F1740C-9E31-4BE1-81FF-62BFD5B568FE
HistoryFeb 02, 2024 - 12:00 a.m.

Essential Addons for Elementor < 5.9.8 - Contributor+ Stored XSS

2024-02-0200:00:00
wpscan.com
5
stored xss
elementor
contributor
input sanitization
output escaping

5.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

13.7%

Description The plugin is vulnerable to Stored Cross-Site Scripting through editing context via the ‘data-eael-wrapper-link’ wrapper due to insufficient input sanitization and output escaping on user supplied protocols, allowing authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CPENameOperatorVersion
eq5.9.8

5.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

13.7%

Related for WPVDB-ID:D6F1740C-9E31-4BE1-81FF-62BFD5B568FE