VulnerabilityModified
CVE-2021-24266
The “The Plus Addons for Elementor Page Builder Lite” WordPress Plugin before 2.0.6 has four widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
MEDIUM 5.4EPSS 0.59%
Does this matter?
Lower severity and a low EPSS score (0.59%). Track it; it rarely justifies an emergency change on its own.
Description
The “The Plus Addons for Elementor Page Builder Lite” WordPress Plugin before 2.0.6 has four widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
- CVSS 3.1
- 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.59% probability · 46th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- posimyth/the plus addons for elementor page builder lite
- Source
- contact@wpscan.com
References
- https://wpscan.com/vulnerability/78014ddd-1cc2-4723-8194-4bf478888578Third Party Advisory
- https://www.wordfence.com/blog/2021/04/recent-patches-rock-the-elementor-ecosystem/Third Party Advisory
- https://wpscan.com/vulnerability/78014ddd-1cc2-4723-8194-4bf478888578Third Party Advisory
- https://www.wordfence.com/blog/2021/04/recent-patches-rock-the-elementor-ecosystem/Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.