ElementsKit: stored cross-site scripting (XSS) (CVE-2024-10091) #shorts #breaking

CVE

This CVE involves a stored cross-site scripting vulnerability found in the ElementsKit Elementor Addons Plugin for WordPress. It was discovered zero months ago and is considered a zero-day attack, as it exploits a flaw in the plugin's Image Comparison Widget. This security flaw arises from the plugin's failure to adequately sanitize and escape user inputs. Consequently, attackers who have at least contributor-level access can inject harmful scripts into web pages. When an unsuspecting user visits these compromised pages, the injected scripts run automatically in their browser. This vulnerability affects all versions of ElementsKit up to and including 3.2.9, creating potential security risks for both users and developers relying on this plugin.

This chain involves the following actors

This following systems are involved

Attack entry point

Remediation actions

Exploitation actions

• https://www.wordfence.com/threat-intel/vulnerabilities/id/00b278af-6ce6-4e70-a83a-a1b035542cd4?source=cve
• https://plugins.trac.wordpress.org/browser/elementskit-lite/tags/3.2.9/widgets/image-comparison/image-comparison.php#L657