CVE-2024-10980

MEDIUM

Element Pack Elementor Addons < 5.10.3 - Stored Cross-Site Scripting via Cookie Consent Block Options

Title source: llm

Description

The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) WordPress plugin before 5.10.3 does not validate and escape some of its Cookie Consent block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

References (1)

Core 1

Core References

Exploit, Third Party Advisory exploit vdb-entry technical-description

https://wpscan.com/vulnerability/915daad8-d14c-4457-a3a0-aa21744f4ae0/

Scores

CVSS v3 5.4

EPSS 0.0035

EPSS Percentile 27.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (1)

bdthemes/element_pack < 5.10.3

Published Nov 29, 2024

Tracked Since Feb 18, 2026