CVE Database /
CVE-2021-24206
CVE · Medium
CVE-2021-24206 — Elementor Website Builder – more than just a page builder [elementor] < 3.1.4
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2021-24206
|
Elementor Website Builder – more than just a page builder [elementor] < 3.1.4 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
5.4
|
< 3.1.4
|
3.1.4 |
2021-03-17 |
—
|
CVE-2021-24206
The Elementor Website Builder plugin before version 3.1.4 contains a stored cross-site scripting vulnerability in its image box widget. Users with Contributor-level access or higher can inject malicious JavaScript into the title_size parameter by modifying the save_builder request, bypassing the widget's intended tag restrictions. Since the parameter lacks proper sanitization and output encoding, the injected code executes when the page is viewed or previewed.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings