CVE-2024-0442

Summary

CVE-2024-0442 is a vulnerability in the Royal Elementor Addons and Templates plugin for WordPress, affecting all versions up to 1.3.87. The vulnerability allows authenticated attackers with contributor access or higher to inject arbitrary web scripts in pages using element URL parameters, leading to stored cross-site scripting attacks. The lack of input sanitization and output escaping makes it possible for the injected scripts to execute whenever a user accesses the compromised page. The risk score for this vulnerability is 25, with a base severity of MEDIUM. To remediate this vulnerability, users should update their Royal Elementor Addons and Templates plugin to a version beyond 1.3.87 to ensure proper input sanitization and escape output are implemented. This vulnerability poses a potential danger to organizations as it can be exploited by attackers to execute malicious scripts and potentially compromise user data or launch further attacks on the affected WordPress site.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.