wordpress Vulnerabilities and Affected Products
Vulnerabilities associated with royal-elementor-addons.
Products
Clear product- WordPress28 vulnerabilities
- wordpress-develop17 vulnerabilities
- adserve2 vulnerabilities
- Core2 vulnerabilities
- geo_controller2 vulnerabilities
- max_addons_pro_for_bricks2 vulnerabilities
- royal-elementor-addons2 vulnerabilities
- absolutely_glamorous_custom_admin1 vulnerability
- acf-on-the-go1 vulnerability
- BuddyBoss Theme1 vulnerability
- Buddypress1 vulnerability
- buddypress_cover1 vulnerability
- checkout_mestres1 vulnerability
- contact_form_drag_and_drop_form_builder1 vulnerability
- counter_box1 vulnerability
- cssigniter_elements_team1 vulnerability
- customer_reviews_for_woocommerce1 vulnerability
- directorist1 vulnerability
- easy_social_feed1 vulnerability
- elementsready_addons_for_elementor1 vulnerability
- elespare1 vulnerability
- email_customizer_for_woocommerce1 vulnerability
- enl_newsletter1 vulnerability
- external_database_based_actions1 vulnerability
- File Manager Plugin1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2024-2798MEDIUM | Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) DOM-Based Stored Cross-Site ScriptingThe Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget containers in all versions up to, and including, 1.3.971 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CWE-79Apr 23, 2024 | CVSS6.4v3.1 | EPSS0.336% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-2799MEDIUM | Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML TagsThe Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Grid & Advanced Text widget HTML tags in all versions up to, and including, 1.3.96 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CWE-79Apr 23, 2024 | CVSS6.4v3.1 | EPSS0.434% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |