CVE-2021-24268: JetWidgets For Elementor < 1.0.9 - Contributor+ Stored XSS
Published May 5, 2021
·Updated
The “JetWidgets For Elementor” WordPress Plugin before 1.0.9 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Affected Software
1 affected component
Crocoblock Jetwidgets For Elementor Wordpress<1.0.9
Event History
May 5, 2021
CVE Published
via MITRE·06:28 PM
Data Sourced
via MITRE·06:28 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-24268?
The severity of CVE-2021-24268 is classified as high due to the potential for stored Cross-Site Scripting (XSS) attacks.
2
How do I fix CVE-2021-24268?
To fix CVE-2021-24268, update the JetWidgets for Elementor plugin to version 1.0.9 or later.
3
Who is affected by CVE-2021-24268?
CVE-2021-24268 affects users of the JetWidgets for Elementor plugin who have lower-privileged user roles, such as contributors.
4
What type of vulnerability is CVE-2021-24268?
CVE-2021-24268 is a stored Cross-Site Scripting (XSS) vulnerability.
5
Can CVE-2021-24268 be exploited by malicious users?
Yes, CVE-2021-24268 can be exploited by malicious lower-privileged users to inject harmful scripts.