CVE Database /
CVE-2021-24201
CVE · Medium
CVE-2021-24201 — Elementor Website Builder – more than just a page builder [elementor] < 3.1.4
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2021-24201
|
Elementor Website Builder – more than just a page builder [elementor] < 3.1.4 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
5.4
|
< 3.1.4
|
3.1.4 |
2021-03-17 |
—
|
CVE-2021-24201
The Elementor Website Builder plugin before version 3.1.4 contains a stored cross-site scripting vulnerability in the column element. Users with Contributor level permissions or higher can inject malicious JavaScript through the 'html_tag' parameter in modified save_builder requests, bypassing the control restrictions that normally limit tag selection. Since the injected code is neither sanitized nor escaped during output, the JavaScript executes whenever the affected page is viewed or previewed.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings