WooLentor - WooCommerce Elementor Addons + Builder < 1.8.6 - Contributor+ Stored XSS

Description

The “WooLentor – WooCommerce Elementor Addons + Builder” WordPress Plugin before 1.8.6 has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.

The “Product Title” widget accepts a “product_title_html_tag” parameter. Although the element control lists a fixed set of possible html tags, it is possible to send a ‘save_builder’ request containing JavaScript in the “product_title_html_tag” parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.

This vulnerability is nearly identical to the vulnerabilities we have recently disclosed in the main Elementor plugin: https://www.wordfence.com/blog/2021/03/cross-site-scripting-vulnerabilities-in-elementor-impact-over-7-million-sites/