The “All-in-One Addons for Elementor – WidgetKit” WordPress Plugin before 2.3.10 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method. The “Content Carousel” widget accepts “custom_header_tag” and “post_header_tag” parameters. Although the element control lists a fixed set of possible html tags, it is possible to send a ‘save_builder’ request containing JavaScript in these parameters, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed. Additionally the following widgets appear to have similar vulnerabilities in the following parameters: testimonial: custom_header_tag parameter slider-1: heading_tag parameter slider-2: heading_tag parameter slider-3: heading_tag parameter team: header_tag parameter testimonial: custom_header_tag parameter These vulnerabilities are nearly identical to the vulnerabilities we have recently disclosed in the main Elementor plugin: https://www.wordfence.com/blog/2021/03/cross-site-scripting-vulnerabilities-in-elementor-impact-over-7-million-sites/
Ramuel Gall
Ramuel Gall
Yes
2021-04-13 (about 1 years ago)
2021-04-14 (about 1 years ago)
2021-04-18 (about 1 years ago)