CVE-2021-24257

The Premium Addons for Elementor plugin before version 4.2.8 contains stored cross-site scripting vulnerabilities in multiple widgets that can be exploited by lower-privileged users such as contributors. Attackers can inject malicious JavaScript through various widget parameters including the Testimonials widget's name and company name size fields, the Premium Blog widget's title tag, and parameters in the Banner, Dual Header, Person, Pricing Table, and Title widgets by bypassing incomplete input sanitization. The injected scripts execute when pages containing these widgets are viewed or previewed. These vulnerabilities stem from inadequate filtering of externally sourced JavaScript in widget configuration parameters.

Based on public CVE data (MITRE/NVD).