WordPress Plugin Vulnerabilities

PowerPack Addons for Elementor < 2.7.16 - Contributor+ Stored Cross-Site Scripting

Description

The plugin does not properly sanitize its Twitter Buttons Widget setting, allowing users with at least the contributor role to conduct Stored XSS attacks.

Affects Plugins

Plugin icon
powerpack-lite-for-elementor
Fixed in 2.7.16

References

CVE
CVE-2024-1411
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/64480862-c076-4ea9-a03b-9aed81f876d5

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.4 (medium)

Miscellaneous

Original Researcher
wesley (wcraft)
Verified
No
WPVDB ID
096ffe18-7540-4763-a734-b0c40dfc4922

Timeline

Publicly Published
2024-02-15 (about 2 years ago)
Added
2024-02-15 (about 2 years ago)
Last Updated
2024-02-15 (about 2 years ago)

Other

Published
Title
Published
2022-09-01
Title
Word Search Puzzles Game <= 2.0.1 - Author+ Stored Cross-Site Scripting
Published
2025-09-08
Title
Postie < 1.9.71 - Admin+ Stored XSS
Published
2025-12-30
Title
Yada Wiki < 3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2021-02-19
Title
Testimonial Rotator <= 3.0.3 - Authenticated Stored Cross-Site Scripting
Published
2014-08-01
Title
A Forms 1.4.0 - a-forms.php a_form_page Function Multiple Parameter XSS