CVE-2024-4643 Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
MediumCVSS 5.4
EPSS 0.37%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘end_redirect_link’ parameter in versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wordpress bdthemes-element-pack-lite(WordPress) | < 5.6.12 | 5.6.12 |
| bdthemes Element Pack – Widgets, Templates & Addons for Elementor | <= 5.6.11 | No fix listed |
| bdthemes element pack | <= 5.7.1 | No fix listed |
References
- Wordfence Intelligence third-party-advisory
- www.cve.org
- www.wordfence.com third-party-advisory
- plugins.trac.wordpress.org patch
- plugins.trac.wordpress.org
- plugins.trac.wordpress.org