PT-2021-15751 · WordPress · Elementor Website Builder

Ramuel Gall · Published 2021-04-05 · Updated 2021-04-09 · CVE-2021-24206

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Elementor Website Builder WordPress plugin versions prior to 3.1.4

Description: The issue allows a user with Contributor or above permissions to inject JavaScript into the title size parameter of the image box widget. This JavaScript is not filtered and is output without escaping, leading to its execution when the saved page is viewed or previewed. The element control lists a fixed set of possible HTML tags, but it is still possible to send a modified save builder request containing malicious JavaScript.

Recommendations: For versions prior to 3.1.4, update to version 3.1.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the image box widget for users with Contributor or above permissions until the update is applied. Avoid using the title size parameter in the affected widget until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24206

Affected Products

Elementor Website Builder

References · 5

• 🔥 https://wordfence.com/blog/2021/03/cross-site-scripting-vulnerabilities-in-elementor-impact-over-7-million-sites · Exploit
• 🔥 https://wpscan.com/vulnerability/2f66efd9-7d55-4f33-9109-3cb583a0c309 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24206 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24206 · Vendor Advisory
• https://t.me/cvenotify/13021 · Telegram Post