CVE-2024-9867

Summary

CVE-2024-9867 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Elementor Addons plugin for WordPress, specifically the Header Footer, Template Library, Dynamic Grid & Carousel, and Remote Arrows components. The issue lies in the 'Open Map Widget' marker_content parameter, which fails to implement adequate input sanitization and output escaping. Attackers with Contributor-level access or higher can exploit this flaw to inject malicious web scripts into pages, causing them to execute whenever a user accesses an injected page. This could potentially lead to unintended website functionality, data theft, or unauthorized access. It is recommended that users update to the latest version (5.10.3 or later) of the affected plugins to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.