CVE-2024-13155

The Unlimited Elements For Elementor plugin for WordPress contains a Stored Cross-Site Scripting vulnerability in the Transparent Split Hero widget that affects versions up to and including 1.5.140. The flaw stems from inadequate sanitization and escaping of user-supplied widget attributes, allowing authenticated users with contributor-level permissions or higher to inject malicious scripts into pages that execute when other users view them. To resolve this issue, users must manually remove and reinstall the affected Transparent Split Hero widget since it exists outside the main plugin codebase.

Based on public CVE data (MITRE/NVD).