Elementor < 2.9.8 - SVG Sanitizer Bypass leading to Authenticated Stored XSS
Description
Jerome Bruandet, from NinTechNet, discovered a bypass in the SVG sanitizer, which could lead to an authenticated stored XSS issue from users with the upload_files capability.
Affects Plugins
Fixed in version 2.9.8✓
Classification
Type
BYPASS
Miscellaneous
Original Researcher
Jerome Bruandet (NinTechNet)
Verified
No
Timeline
Publicly Published
2020-05-06 (about 1 years ago)
Added
2020-05-06 (about 1 years ago)
Last Updated
2020-05-07 (about 1 years ago)