CVE Database /
CVE-2024-2455
CVE · Medium
CVE-2024-2455 — Element Pack Pro [bdthemes-element-pack] < 7.9.1
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2024-2455
|
Element Pack Pro [bdthemes-element-pack] < 7.9.1 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
5.4
|
< 7.9.1
|
7.9.1 |
2024-07-31 |
—
|
CVE-2024-2455
The Element Pack Pro plugin for WordPress contained a stored cross-site scripting vulnerability in versions up to 7.9.0 caused by inadequate sanitization of the widget wrapper link URL parameter and insufficient escaping of user-controlled attributes. Attackers with contributor-level permissions or higher could inject malicious scripts that would execute for any user viewing the affected pages. This vulnerability was resolved in version 7.9.1.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings