PT-2021-15746 · WordPress · Elementor Website Builder

Ramuel Gall · Published 2021-04-05 · Updated 2021-04-09 · CVE-2021-24201

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Elementor Website Builder WordPress plugin versions prior to 3.1.4

Description: The issue concerns the column element in the Elementor Website Builder WordPress plugin, where a user with Contributor or above permissions can manipulate the html tag parameter to inject JavaScript. This JavaScript is not filtered and is output without escaping, leading to its execution when the saved page is viewed or previewed.

Recommendations: For versions prior to 3.1.4, update to version 3.1.4 or later to resolve the issue. As a temporary workaround, consider restricting the ability to modify the html tag parameter for users with Contributor or above permissions until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24201

Affected Products

Elementor Website Builder

References · 4

• 🔥 https://wordfence.com/blog/2021/03/cross-site-scripting-vulnerabilities-in-elementor-impact-over-7-million-sites · Exploit
• 🔥 https://wpscan.com/vulnerability/9647f516-b130-4cc8-85fb-2e69b034ced0 · Exploit
• https://osv.dev/vulnerability/CVE-2021-24201 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24201 · Security Note