CVE Database /
CVE-2024-54444
CVE · Medium
CVE-2024-54444 — Elementor Website Builder – more than just a page builder [elementor] < 3.25.11
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2024-54444
|
Elementor Website Builder – more than just a page builder [elementor] < 3.25.11 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
6.5
|
< 3.25.11
|
3.25.11 |
2025-02-24 |
—
|
CVE-2024-54444
The Elementor Website Builder plugin for WordPress contains a stored cross-site scripting vulnerability affecting versions 3.25.10 and earlier. Attackers with contributor-level or higher privileges can inject malicious scripts into pages because the plugin fails to properly sanitize input and escape output. When users view pages containing this injected code, the scripts execute in their browsers. The vulnerability was patched in version 3.25.11.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings