WordPress Plugin Vulnerabilities

Plexx Elementor Extension < 1.3.7 - Contributor+ Stored XSS

Description

The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
plexx-elementor-extension
Fixed in 1.3.7

References

CVE
CVE-2024-49234
URL
https://patchstack.com/database/vulnerability/plexx-elementor-extension/wordpress-plexx-elementor-extension-plugin-1-3-4-cross-site-scripting-xss-vulnerability

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.9 (medium)

Miscellaneous

Original Researcher
Khalid Yusuf
Verified
No
WPVDB ID
8802f53c-15ad-42bf-9e63-f1705e2f577a

Timeline

Publicly Published
2024-10-14 (about 1 year ago)
Added
2024-10-18 (about 1 year ago)
Last Updated
2024-10-21 (about 1 year ago)

Other

Published
Title
Published
2025-04-02
Title
User Submitted Posts < 20250327 - Authenticated (Admin+) Stored Cross-Site Scripting
Published
2023-12-06
Title
Annual Archive <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-09-22
Title
Sales Count Manager for WooCommerce <= 2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2024-03-25
Title
Booster for WooCommerce < 7.1.8 - Reflected Cross-Site Scripting
Published
2023-10-09
Title
E2Pdf < 1.20.20 - Admin+ Stored Cross-Site Scriping