CVEvulnerability
CVE-2024-3718
5.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2024-05-24
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
Description
The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's widgets all versions up to, and including, 5.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-35709 is likely a duplicate of this issue.
Affected configurations
• posimyth the plus addons for elementor (< 5.5.5)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://plugins.trac.wordpress.org/browser/the-plus-addons-for-elementor-page-builder/tags/5.4.2/modules/widgets/tp_age_gate.php#L2304 Product
- https://plugins.trac.wordpress.org/browser/the-plus-addons-for-elementor-page-builder/tags/5.4.2/modules/widgets/tp_flip_box.php#L2349 Product
- https://plugins.trac.wordpress.org/browser/the-plus-addons-for-elementor-page-builder/tags/5.4.2/modules/widgets/tp_header_extras.php#L2757 Product
- https://plugins.trac.wordpress.org/browser/the-plus-addons-for-elementor-page-builder/tags/5.4.2/modules/widgets/tp_hovercard.php#L2648 Product
- https://plugins.trac.wordpress.org/browser/the-plus-addons-for-elementor-page-builder/tags/5.4.2/modules/widgets/tp_pricing_table.php#L2869 Product
- https://plugins.trac.wordpress.org/browser/the-plus-addons-for-elementor-page-builder/tags/5.4.2/modules/widgets/tp_progress_bar.php#L1161 Product
- https://plugins.trac.wordpress.org/browser/the-plus-addons-for-elementor-page-builder/tags/5.4.2/modules/widgets/tp_scroll_navigation.php#L1143 Product
- https://plugins.trac.wordpress.org/changeset/3090866/ Patch
- https://www.wordfence.com/threat-intel/vulnerabilities/id/1b73402b-444c-47ad-9c05-7be6e6440123?source=cve Third Party Advisory
- https://plugins.trac.wordpress.org/browser/the-plus-addons-for-elementor-page-builder/tags/5.4.2/modules/widgets/tp_age_gate.php#L2304 Product
- https://plugins.trac.wordpress.org/browser/the-plus-addons-for-elementor-page-builder/tags/5.4.2/modules/widgets/tp_flip_box.php#L2349 Product
- https://plugins.trac.wordpress.org/browser/the-plus-addons-for-elementor-page-builder/tags/5.4.2/modules/widgets/tp_header_extras.php#L2757 Product
- https://plugins.trac.wordpress.org/browser/the-plus-addons-for-elementor-page-builder/tags/5.4.2/modules/widgets/tp_hovercard.php#L2648 Product
- https://plugins.trac.wordpress.org/browser/the-plus-addons-for-elementor-page-builder/tags/5.4.2/modules/widgets/tp_pricing_table.php#L2869 Product
- https://plugins.trac.wordpress.org/browser/the-plus-addons-for-elementor-page-builder/tags/5.4.2/modules/widgets/tp_progress_bar.php#L1161 Product
- https://plugins.trac.wordpress.org/browser/the-plus-addons-for-elementor-page-builder/tags/5.4.2/modules/widgets/tp_scroll_navigation.php#L1143 Product
- https://plugins.trac.wordpress.org/changeset/3090866/ Patch
- https://www.wordfence.com/threat-intel/vulnerabilities/id/1b73402b-444c-47ad-9c05-7be6e6440123?source=cve Third Party Advisory