CVE-2024-10323

Summary

CVE-2024-10323 is a newly disclosed vulnerability that affects the JetWidgets For Elementor plugin for WordPress. Maliciously crafted SVG files, when uploaded via the plugin's REST API, can bypass input sanitization and output escaping checks. Consequently, authenticated attackers, with Author-level access or higher, can inject arbitrary web scripts that get executed whenever a user accesses the affected SVG file, potentially leading to Cross-Site Scripting attacks. This issue impacts all versions of the plugin up to, and including, 1.0.18. It is strongly recommended that users update to the latest available version to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.