WordPress Plugin Vulnerabilities

Premium Addons for Elementor < 4.10.70 - Contributor+ Stored XSS

Description

The plugin is vulnerable to Stored Cross-Site Scripting via the plugin's linkURL in the Mobile Menu element due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
premium-addons-for-elementor
Fixed in 4.10.70

References

CVE
CVE-2024-11937
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/26337385-646f-4129-99be-7fa020f67f8e

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.9 (medium)

Miscellaneous

Original Researcher
zer0gh0st
Verified
No
WPVDB ID
2e6c620b-2b02-4d1a-9ceb-8baec574fc64

Timeline

Publicly Published
2025-07-03 (about 10 months ago)
Added
2025-07-04 (about 10 months ago)
Last Updated
2025-07-04 (about 10 months ago)

Other

Published
Title
Published
2025-12-31
Title
Cooked < 1.11.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2022-02-18
Title
Essential Addons for Elementor Lite < 5.0.9 - Reflected Cross-Site Scripting
Published
2023-11-15
Title
WooCommerce <= 8.1.1 & WooCommerce Blocks <= 11.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image alt Attribute
Published
2024-07-11
Title
PowerPress Podcasting plugin by Blubrry < 11.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via media_url Parameter
Published
2025-09-29
Title
FancyTabs <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter