WordPress Plugin Vulnerabilities

WPB Elementor Addons < 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description

The WPB Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, <=1.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
wpb-elementor-addons
Fixed in 1.2

References

CVE
CVE-2024-34791
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/413e3430-2d9b-4b14-90da-99de44b393e3

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.4 (medium)

Miscellaneous

Verified
No
WPVDB ID
40063f22-e7d1-4b46-9ddc-878b07634bda

Timeline

Publicly Published
2024-05-17 (about 2 years ago)
Added
2024-05-21 (about 2 years ago)
Last Updated
2024-05-29 (about 1 year ago)

Other

Published
Title
Published
2024-08-07
Title
Blockspare < 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2023-05-15
Title
Stop Spammers Security < 2023 - Admin+ Stored XSS
Published
2026-03-17
Title
Code Embed < 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Fields
Published
2024-05-07
Title
Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) < 1.1.35 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-03-15
Title
MJM Clinic < 1.1.23 - Authenticated (Editor+) Stored Cross-Site Scripting