The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Open Map Widget' marker_content parameter in all versions up to, and including, 5.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
References
| Link | Resource |
|---|---|
| https://www.wordfence.com/threat-intel/vulnerabilities/id/cca2bd96-ac3c-480c-8fe7-fb5227a093ae?source=cve | Third Party Advisory |
| https://plugins.trac.wordpress.org/changeset/3180563/ | Patch |
Configurations
History
08 Nov 2024, 16:00
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:bdthemes:element_pack:*:*:*:*:lite:wordpress:*:* | |
| First Time |
Bdthemes element Pack
Bdthemes |
|
| References | () https://plugins.trac.wordpress.org/changeset/3180563/ - Patch | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/cca2bd96-ac3c-480c-8fe7-fb5227a093ae?source=cve - Third Party Advisory |
05 Nov 2024, 12:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-11-05 12:15
Updated : 2024-11-08 16:00
NVD link : CVE-2024-9867
Mitre link : CVE-2024-9867
JSON object : View
Products Affected
bdthemes
- element_pack
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')