PT-2021-15749 · WordPress · Elementor Website Builder

Ramuel Gall · Published 2021-04-05 · Updated 2021-04-09 · CVE-2021-24204

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Elementor Website Builder WordPress plugin versions prior to 3.1.4

Description: The issue concerns the accordion widget in the Elementor Website Builder WordPress plugin. A user with Contributor or above permissions can send a modified 'save builder' request containing JavaScript in the title html tag parameter. This JavaScript is not filtered and is output without escaping, allowing it to be executed when the saved page is viewed or previewed.

Recommendations: For versions prior to 3.1.4, update to version 3.1.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the accordion widget for users with Contributor or above permissions until the update is applied. Additionally, avoid using the title html tag parameter in the affected accordion widget until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24204

Affected Products

Elementor Website Builder

References · 4

• 🔥 https://wordfence.com/blog/2021/03/cross-site-scripting-vulnerabilities-in-elementor-impact-over-7-million-sites · Exploit
• 🔥 https://wpscan.com/vulnerability/772e172f-c8b4-4a6a-9eb9-9663295cfedf · Exploit
• https://osv.dev/vulnerability/CVE-2021-24204 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24204 · Security Note