CVE-2024-5787

Summary

CVE-2024-5787 is a stored cross-site scripting (XSS) vulnerability affecting the PowerPack Addons for Elementor plugin for WordPress. The flaw, present in all versions up to 2.7.20, can be exploited by authenticated attackers with Contributor-level access or higher. The vulnerability lies in the 'url' attribute of the plugin's Link Effects widget, which lacks proper input sanitization and output escaping. As a result, attackers can inject arbitrary web scripts, which will execute whenever a user accesses an injected page, posing a significant security risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.