CVE-2024-3650: XSS
The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Accordion widget in all versions 3.0.7 through 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3650?
CVE-2024-3650 has a moderate severity level due to its potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2024-3650?
To fix CVE-2024-3650, upgrade the ElementsKit Elementor addons plugin to version 3.1.3 or later.
Who is affected by CVE-2024-3650?
CVE-2024-3650 affects all versions of the ElementsKit Elementor addons plugin from 3.0.7 to 3.1.2.
What kind of attack can be executed using CVE-2024-3650?
CVE-2024-3650 can be exploited for Stored Cross-Site Scripting attacks by authenticated attackers.
What plugin is associated with CVE-2024-3650?
CVE-2024-3650 is associated with the ElementsKit Elementor addons plugin for WordPress.