Lucene search

K
wpvulndbWpvulndbWPVDB-ID:F7D82994-3FA2-46E9-9439-4863BBE648BA
HistoryJan 26, 2024 - 12:00 a.m.

Exclusive Addons for Elementor < 2.6.9 - Contributor+ Stored XSS

2024-01-2600:00:00
wpscan.com
5
exclusive addons
elementor
stored xss
contributor
cross-site scripting
security
vulnerability

6.1 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.2%

Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin

CPENameOperatorVersion
eq2.6.9

6.1 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.2%

Related for WPVDB-ID:F7D82994-3FA2-46E9-9439-4863BBE648BA