Description Preview
The Elementor Website Builder plugin for WordPress, specifically versions up to and including 3.25.9, is vulnerable to Stored Cross-Site Scripting through the plugin's Typography Settings. This vulnerability arises from inadequate input sanitization and output escaping on user-supplied attributes. As a result, authenticated attackers with contributor-level access and higher can inject malicious web scripts into pages, which will execute whenever a user accesses the compromised page.
Overview
CVE ID: CVE-2024-10453 CVSS Base Score: 6.4 (Medium) CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N Vulnerability Type: Stored Cross-Site Scripting (CWE-79) Vendor: elemntor Product: Elementor Website Builder – More Than Just a Page Builder Affected Versions: Up to and including 3.25.9 Default Status: Unaffected
Remediation
To mitigate the vulnerability, users of the Elementor Website Builder plugin should update to a version beyond 3.25.9. It is crucial to ensure that all user-supplied attributes are properly sanitized and escaped to prevent the injection of malicious scripts. Regularly updating plugins and maintaining good security practices can help prevent such vulnerabilities from being exploited.
References
- Wordfence Advisory: Wordfence Advisory
- WordPress Plugin Repository: Elementor 3.25.9 Editor.js
Industry ExposureMost to leastThis section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
- Transportation & WarehousingTransportation & Warehousing
- Accommodation & Food ServicesAccommodation & Food Services
- Administrative, Support, Waste Management & Remediation ServicesAdministrative, Support, Waste Management & Remediation Services
- Agriculture, Forestry Fishing & HuntingAgriculture, Forestry Fishing & Hunting
- Arts, Entertainment & RecreationArts, Entertainment & Recreation
- ConstructionConstruction
- Educational ServicesEducational Services
- Finance and InsuranceFinance and Insurance
- Health Care & Social AssistanceHealth Care & Social Assistance
- InformationInformation
- Management of Companies & EnterprisesManagement of Companies & Enterprises
- ManufacturingManufacturing
- MiningMining
- Other Services (except Public Administration)Other Services (except Public Administration)
- Professional, Scientific, & Technical ServicesProfessional, Scientific, & Technical Services
- Public AdministrationPublic Administration
- Real Estate Rental & LeasingReal Estate Rental & Leasing
- Retail TradeRetail Trade
- UtilitiesUtilities
- Wholesale TradeWholesale Trade
