CVE-2024-13354: Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates <= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML tags in several widgets in all versions up to, and including, 1.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13354?
CVE-2024-13354 is categorized as a high severity vulnerability due to its potential for stored cross-site scripting attacks.
How do I fix CVE-2024-13354?
To fix CVE-2024-13354, update the Responsive Addons for Elementor plugin to version 1.6.5 or later.
What platforms are affected by CVE-2024-13354?
CVE-2024-13354 affects the Responsive Addons for Elementor plugin on WordPress installations using versions up to and including 1.6.4.
What types of attacks can be executed due to CVE-2024-13354?
CVE-2024-13354 allows attackers to exploit stored cross-site scripting vulnerabilities, potentially executing malicious scripts in the context of a user's session.
Is it safe to use older versions of the Responsive Addons for Elementor plugin after CVE-2024-13354?
No, using versions of the Responsive Addons for Elementor plugin up to and including 1.6.4 is unsafe due to the vulnerability outlined in CVE-2024-13354.