PowerPack Addons for Elementor < 2.7.16 - Contributor+ Stored Cross-Site Scripting

2024-02-1500:00:00

wpscan.com

elementor

powerpack addons

cross-site scripting

contributor

twitter buttons widget

5.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

JSON

Description The plugin does not properly sanitize its Twitter Buttons Widget setting, allowing users with at least the contributor role to conduct Stored XSS attacks.

CPENameOperatorVersion
eq2.7.16

CPE	Name	Operator	Version
		eq	2.7.16

References

www.wordfence.com/threat-intel/vulnerabilities/id/64480862-c076-4ea9-a03b-9aed81f876d5