CVE-2024-7247
CVSS 3.1 Score 6.4 of 10 (medium)
Details
Summary
CVE-2024-7247 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Elementor Addons plugin for WordPress. Versions up to 5.7.2 of the Header Footer, Template Library, Dynamic Grid & Carousel, and Remote Arrows add-ons are susceptible to this issue. The vulnerability arises due to insufficient input sanitization and output escaping on user-supplied attributes in the Custom Gallery and Countdown widgets. Authenticated attackers with contributor-level access or higher can exploit this weakness, injecting malicious web scripts into pages. Consequently, these scripts will execute when an unsuspecting user accesses the manipulated pages.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.