CVE-2021-24258
published 2021-05-05CVE-2021-24258: The Elements Kit Lite and Elements Kit Pro WordPress Plugins before 2.2.0 have a number of widgets that are vulnerable to stored Cross-Site Scripting (XSS) by…
PriorityP278medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
ITWVulnCheck KEV
Exploited in the wild
EPSS
0.63%
45.5th percentile
The Elements Kit Lite and Elements Kit Pro WordPress Plugins before 2.2.0 have a number of widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wpmet | elements_kit_elementor_addons | < 2.2.0 | 2.2.0 |
| wpmet | elements_kit_lite | >= 2.2.0 < 2.2.0 | 2.2.0 |
| wpmet | elements_kit_pro | >= 2.2.0 < 2.2.0 | 2.2.0 |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:N
vulncheck5.4MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-487m-63p5-88hq: The Elements Kit Lite and Elements Kit Pro WordPress Plugins before 2
ghsa_unreviewed·2022-05-24
CVE-2021-24258 [MEDIUM] CWE-79 GHSA-487m-63p5-88hq: The Elements Kit Lite and Elements Kit Pro WordPress Plugins before 2
The Elements Kit Lite and Elements Kit Pro WordPress Plugins before 2.2.0 have a number of widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
VulnCheck
wpmet elements_kit_elementor_addons Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
vulncheck·2021·CVSS 5.4
CVE-2021-24258 [MEDIUM] wpmet elements_kit_elementor_addons Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
wpmet elements_kit_elementor_addons Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The Elements Kit Lite and Elements Kit Pro WordPress Plugins before 2.2.0 have a number of widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Affected: wpmet elements_kit_elementor_addons
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/elementskit-lite/elements-kit-litepro-217-authenticated-contributor-stored-cross-site-scripting
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://wpscan.com/vulnerability/47b47b86-899b-4de3-8a3c-2d5d1774298fhttps://www.wordfence.com/blog/2021/04/recent-patches-rock-the-elementor-ecosystem/https://wpscan.com/vulnerability/47b47b86-899b-4de3-8a3c-2d5d1774298fhttps://www.wordfence.com/blog/2021/04/recent-patches-rock-the-elementor-ecosystem/
2021-05-05
Published
Exploited in the wild