CVE Database /
CVE-2020-13865
CVE · Medium
CVE-2020-13865 — Elementor Website Builder – more than just a page builder [elementor] < 2.9.10
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2020-13865
|
Elementor Website Builder – more than just a page builder [elementor] < 2.9.10 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
5.4
|
< 2.9.10
|
2.9.10 |
2020-06-05 |
—
|
CVE-2020-13865
The Elementor Website Builder plugin versions before 2.9.9 contained multiple stored cross-site scripting flaws that could be exploited by users with author-level permissions. Attackers with these privileges could inject malicious scripts through specially crafted links in custom URL fields or via custom attributes applied to elements. When other users viewed the affected posts, the stored malicious code would execute in their browsers. The vulnerability was addressed in version 2.9.9 and later.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings