The Plus Addons for Elementor < 4.1.12 - Reflected Cross-Site Scripting (XSS)
18Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendepss 2.5%
exploitation probability
2.5%top 17% of all CVEs
observed exploitation
nono source reports it
The theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.12 did not properly sanitise some of its fields, leading to a reflected Cross-Site Scripting (exploitable on both unauthenticated and authenticated users)
Affected products
Unknown · The Plus Addons for Elementor Page Builder