CVE-2024-9868
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
Summary
The Element Pack Elementor Addons plugin for WordPress contains a Stored Cross-Site Scripting vulnerability in the Age Gate Widget 'url' parameter. This vulnerability affects all versions up to and including 5.10.1 due to insufficient input sanitization and output escaping.
Impact
This vulnerability allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These injected scripts will execute whenever a user accesses the affected page. This can lead to various attacks, including theft of sensitive information, session hijacking, or malicious actions performed on behalf of the victim. The impact is considered low for both confidentiality and integrity, with no direct impact on availability. The attack complexity is low, but it does require user interaction.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. The vulnerability has been addressed in version 5.10.2 of the Element Pack Elementor Addons plugin. The fix was committed to the WordPress plugin repository on November 4, 2024.
Mitigation
1. Update the Element Pack Elementor Addons plugin to version 5.10.2 or later. 2. If immediate updating is not possible, consider temporarily disabling the Age Gate Widget feature. 3. Implement strong input validation and output encoding practices for all user-supplied input, especially in the Age Gate Widget. 4. Review and limit user roles and permissions, ensuring only trusted users have Contributor-level access or higher. 5. Regularly audit and monitor for any suspicious activities or unauthorized changes in pages using the Element Pack plugin. 6. Educate users about the risks of XSS attacks and the importance of not clicking on suspicious links or interacting with untrusted content.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Timeline
NVD published the first details for CVE-2024-9868
A CVSS base score of 5.4 has been assigned.
Feedly found the first article mentioning CVE-2024-9868. See article
Feedly estimated the CVSS score as MEDIUM
EPSS Score was set to: 0.05% (Percentile: 15.1%)