CVE-2024-0442

Summary

CVE-2024-0442 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Royal Elementor Addons and Templates plugin for WordPress. This issue, present in versions up to and including 1.3.87, stems from insufficient input sanitization and output escaping in the handling of URL parameters. Consequently, authenticated attackers with contributor access or higher can inject malicious web scripts. These scripts will execute whenever a user accesses a page with the injected content. This vulnerability poses a significant security risk, allowing attackers to steal sensitive user information, perform unauthorized actions, or launch further attacks on the affected WordPress site.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.