nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-6340 CVE-2024-6340
MEDIUM
Premium Addons for Elementor <= 4.10.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
Record summary
CVE-2024-6340 has a selected CVSS score of 6.4 (medium).
Description
The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 4.10.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 4.10.36 and fully patched in version 4.10.37.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 3, 2024 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
Premium Addons for Elementor – Powerful Elementor Templates & WidgetsBrowse leap13 / Premium Addons for Elementor – Powerful Elementor Templates & WidgetsDefault status: unaffected | CVE List | Through 4.10.36 | affected |
premium_addons_for_elementorBrowse leap13 / premium_addons_for_elementorDefault status: unknown | CVE List | Through 4.10.35 | affected |
References
6plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/trunk/assets/frontend/js/premium-countdown-timer.js plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3111117 plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3115459 wordpress.org
https://wordpress.org/plugins/premium-addons-for-elementor wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/9ed80507-f3e5-45a8-9498-8cebf97155ff?source=cve