WordPress Plugin Vulnerabilities

Fancy Elementor Flipbox < 2.5.2 - Contributor+ Stored XSs via Fancy Elementor Flipbox Widget

Description

The plugin is vulnerable to Stored Cross-Site Scripting via the Fancy Elementor Flipbox widget due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
fancy-elementor-flipbox
Fixed in 2.5.2

References

CVE
CVE-2024-2349
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/c877ac24-a6da-4e61-a669-a0224c9e3bb5

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.9 (medium)

Miscellaneous

Original Researcher
Francesco Carlucci
Verified
No
WPVDB ID
1af6f15d-e4de-42ad-a874-933cb97778ca

Timeline

Publicly Published
2024-04-29 (about 2 years ago)
Added
2024-04-29 (about 2 years ago)
Last Updated
2024-10-15 (about 1 year ago)

Other

Published
Title
Published
2022-01-12
Title
PowerPack Lite for Beaver Builder < 1.2.9.3 - Reflected Cross-Site Scripting
Published
2023-10-19
Title
Eonet Manual User Approve <= 2.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2024-02-01
Title
Add Customer for WooCommerce < 1.7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2020-08-19
Title
Change WordPress Login Logo < 1.1.5 - Authenticated Stored Cross-Site Scripting
Published
2024-08-07
Title
Fuse Social Floating Sidebar < 5.4.11 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload