PT-2024-16315 · WordPress · Element Pack Elementor Addons

Dmitry Ignatyev · Published 2024-11-28 · Updated 2025-05-15 · CVE-2024-10493

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Element Pack Elementor Addons plugin for WordPress versions prior to 5.10.3

Description The issue concerns the Element Pack Elementor Addons plugin for WordPress, which does not validate and escape some of its block options before outputting them back in a page or post where the block is embedded. This could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Recommendations For versions prior to 5.10.3, update the Element Pack Elementor Addons plugin to version 5.10.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of the vulnerable block options until a patch is available. Avoid using the vulnerable block options in the affected API endpoints until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-10493

Affected Products

Element Pack Elementor Addons

References · 8

• 🔥 https://wpscan.com/vulnerability/2e7f7196-054b-4cfd-9219-c60bb8275e8d · Exploit
• https://osv.dev/vulnerability/CVE-2024-10493 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10493 · Security Note
• https://twitter.com/CVEnew/status/1862018767133511754 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1862081093798625530 · Twitter Post
• https://twitter.com/oktsec/status/1862038129911177617 · Twitter Post
• https://t.me/cvenotify/122384 · Telegram Post
• https://t.me/cvenotify/102732 · Telegram Post