Joel Beleña

Name of the Vulnerable Software and Affected Versions: Elementor Website Builder WordPress plugin versions prior to 3.4.8 Description: The issue arises from the plugin's failure to sanitise or escape user input appended to the DOM via a malicious hash, resulting in a DOM Cross-Site Scripting problem. This allows malicious scripts to be executed, potentially leading to unauthorized actions on the website. Recommendations: For versions prior to 3.4.8, update to version 3.4.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's functionality that appends user input to the DOM until a patch is applied.