CVE-2024-1411

Summary

CVE-2024-1411 is a stored Cross-Site Scripting (XSS) vulnerability affecting the PowerPack Addons for Elementor plugin for WordPress. The issue lies in the settings of the Twitter Buttons Widget, which fails to sanitize and escape user input properly. This flaw allows authenticated attackers with contributor-level access or higher to inject malicious scripts into pages. Once executed, these scripts can manipulate a user's browser and steal sensitive information or take control of their account. The vulnerability affects all versions of the plugin up to and including 2.7.15.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.