First published: Sat Mar 29 2025(Updated: )
The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Timer Widget ekit_countdown_timer_title parameter in all versions up to, and including, 3.4.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Credit: security@wordfence.com
Affected Software | Affected Version | How to fix |
---|---|---|
ElementsKit | <=3.4.7 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2024-11180 is considered a high severity vulnerability due to the potential for stored cross-site scripting attacks.
To fix CVE-2024-11180, update the ElementsKit Elementor addons plugin to version 3.4.8 or later.
CVE-2024-11180 affects all versions of ElementsKit Elementor addons up to and including version 3.4.7.
CVE-2024-11180 can facilitate stored cross-site scripting (XSS) attacks that may compromise user data.
The ekit_countdown_timer_title parameter is linked to CVE-2024-11180 and is vulnerable due to insufficient input sanitization.