CVE-2021-24201: Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Column Element
In the Elementor Website Builder WordPress plugin before 3.1.4, the column element (includes/elements/column.php) accepts an ‘htmltag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘savebuilder’ request containing JavaScript in the ‘htmltag’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
Other sources
In the Elementor Website Builder WordPress plugin before 3.1.4, the column element (includes/elements/column.php) accepts an ‘htmltag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘savebuilder’ request containing JavaScript in the ‘htmltag’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-24201?
CVE-2021-24201 is a vulnerability in the Elementor Website Builder WordPress plugin before version 3.1.4 that allows a user with Contributor or above permissions to send a modified 'html_tag' parameter to the column element, potentially leading to cross-site scripting (XSS) attacks.
What is the severity of CVE-2021-24201?
CVE-2021-24201 has a severity rating of medium with a CVSS score of 5.4.
How does CVE-2021-24201 affect the Elementor Website Builder WordPress plugin?
CVE-2021-24201 affects the column element (includes/elements/column.php) in the Elementor Website Builder WordPress plugin before version 3.1.4.
How can a user exploit CVE-2021-24201?
A user with Contributor or above permissions can exploit CVE-2021-24201 by sending a modified 'html_tag' parameter to the column element, potentially allowing for cross-site scripting (XSS) attacks.
Is there a fix for CVE-2021-24201?
Yes, updating the Elementor Website Builder plugin to version 3.1.4 or newer will fix the CVE-2021-24201 vulnerability.