CVE-2021-24205: Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Icon Box Widget
In the Elementor Website Builder WordPress plugin before 3.1.4, the icon box widget (includes/widgets/icon-box.php) accepts a ‘titlesize’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘savebuilder’ request containing JavaScript in the ‘titlesize’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-24205?
CVE-2021-24205 is a vulnerability in the Elementor Website Builder WordPress plugin before 3.1.4.
How severe is CVE-2021-24205?
CVE-2021-24205 has a severity level of 5.4 (medium).
What is the affected software of CVE-2021-24205?
The affected software of CVE-2021-24205 is Elementor Website Builder WordPress plugin before version 3.1.4.
How can I fix CVE-2021-24205?
To fix CVE-2021-24205, update the Elementor Website Builder WordPress plugin to version 3.1.4 or later.
What is the CWE of CVE-2021-24205?
CVE-2021-24205 is classified under CWE-79, which is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').