CVE-2024-1276

CVSS 3.1 Score 6.4 of 10 (medium)

Details

Published Feb 29, 2024

Summary

CVE-2024-1276: The Essential Addons for Elementor plugin for WordPress, versions up to 5.9.8, is vulnerable to Stored Cross-Site Scripting (XSS) attacks. Attackers with contributor access or higher can exploit the insufficient input sanitization and output escaping in the Content Ticker arrow attribute, allowing them to inject arbitrary web scripts. These scripts execute whenever a user accesses an injected page, posing a significant security risk.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share