CVE Database /
CVE-2024-4669
CVE · Medium
CVE-2024-4669 — Events Addon for Elementor [events-addon-for-elementor] < 2.1.7
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2024-4669
|
Events Addon for Elementor [events-addon-for-elementor] < 2.1.7 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
5.4
|
< 2.1.7
|
2.1.7 |
2024-06-11 |
—
|
CVE-2024-4669
The Events Addon for Elementor plugin contains a stored cross-site scripting vulnerability affecting the Basic Slider, Upcoming Events, and Schedule widgets in versions up to 2.1.4. Attackers with contributor-level permissions or higher can inject malicious scripts through insufficiently sanitized widget attributes, which then execute for all users viewing the affected pages. The vulnerability stems from inadequate input validation and output encoding of user-controlled data.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings