CVE-2024-1236

CVSS 3.1 Score 8.5 of 10 (high)

Details

Published Feb 29, 2024

Updated: Jan 8, 2025

CWE ID 862

Summary

CVE-2024-1236 is a stored cross-site scripting (XSS) vulnerability affecting the Essential Addons for Elementor plugin for WordPress. This issue, present in all versions up to 5.9.8, allows authenticated attackers with contributor access or higher to inject malicious web scripts. The vulnerability arises due to insufficient input sanitization and output escaping in the Filterable Controls label icon parameter. Successful exploitation of this flaw results in the execution of injected scripts whenever a user accesses an affected page.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

W3 Total Cache

Affected Vendors

W3 EDGE

Advisories, Assessments, and Mitigations

https://app.recordedfuture.com/live/sc/entity/2ba7g6
https://www.cve.org/CVERecord?id=CVE-2024-1236
https://nvd.nist.gov/vuln/detail/CVE-2024-1236

Back to Vulnerability Database

Platform Features

Products

Use Cases

Teams

Industries

Services

Measuring the US-China AI Gap

TerraStealerV2 and TerraLogger: Golden Chickens' New Malware Families Discovered

Uncovering MintsLoader With Recorded Future Malware Intelligence Hunting

Know What Matters

For Customers

For Partners