CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
The Plus Addons for Elementor plugin for WordPress was vulnerable to Authenticated (Contributor+) Stored Cross-Site Scripting via the Button widget's `custom_attributes` setting in versions up to and including 6.4.11. The `render` function in `modules/widgets/tp_button.php` passed the raw `custom_attributes` string through `tp_senitize_js_input()`. This filter is bypassable. The issue is patched in version 6.4.12.
Explanation of Vulnerability in Simple Terms
The Plus Addons for Elementor contains a stored cross-site scripting (XSS) vulnerability in versions up to 6.4.11. An authenticated user with low privileges can inject malicious scripts that execute in the browsers of other site visitors, potentially compromising their sessions or stealing sensitive data. The vulnerability affects the plugin's scope across the site, not just isolated components.
What an attacker can do
Inject malicious scripts that run in other users' browsers when they view affected pages.
Potential impact on your site
Visitors' sessions and data can be compromised; site reputation and user trust may be damaged.
Conditions required to exploit
Attacker must have a low-privilege user account (e.g., subscriber or contributor role) on the site.
Key dates
External resources
Related vulnerabilities
