CVE-2021-24206: XSS
First published: Mon Apr 05 2021(Updated: )
In the Elementor Website Builder WordPress plugin before 3.1.4, the image box widget (includes/widgets/image-box.php) accepts a ‘title_size’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘title_size’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
Credit: contact@wpscan.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Elementor Website Builder WordPress | <3.1.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this Elementor Website Builder WordPress plugin vulnerability?
The vulnerability ID for this Elementor Website Builder WordPress plugin vulnerability is CVE-2021-24206.
What is the severity level of CVE-2021-24206?
The severity level of CVE-2021-24206 is medium with a CVSS score of 5.4.
What is the affected software of CVE-2021-24206?
The affected software of CVE-2021-24206 is Elementor Website Builder WordPress plugin up to version 3.1.4.
What is the CWE category associated with CVE-2021-24206?
The CWE category associated with CVE-2021-24206 is CWE-79 (Cross-Site Scripting).
How can I fix the Elementor Website Builder WordPress plugin vulnerability (CVE-2021-24206)?
To fix the Elementor Website Builder WordPress plugin vulnerability (CVE-2021-24206), you should update to version 3.1.4 or later.
- collector/nvd-index
- agent/weakness
- agent/references
- agent/severity
- agent/author
- agent/tags
- agent/type
- agent/description
- agent/event
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- vendor/elementor
- canonical/elementor website builder wordpress