← back
CVE-2021-24891

Elementor < 3.4.8 - DOM Cross-Site-Scripting

EPSS 24.0%CWE-79
The Elementor Website Builder WordPress plugin before 3.4.8 does not sanitise or escape user input appended to the DOM via a malicious hash, resulting in a DOM Cross-Site Scripting issue.
Affected products
Unknown · Elementor Website Builder

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://wpscan.com/vulnerability/fbed0daa-007d-4f91-8d87-4bca7781de2dhttps://www.jbelamor.com/xss-elementor-lightox.html