Executive Summary

The Prime Elementor Addons – Lightweight Elementor Widgets for Faster Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the Widget HTML Tag Settings in all versions up to and including 1.3.3.

This vulnerability exists because the plugin does not properly sanitize input or escape output, allowing authenticated users with contributor-level access or higher to inject arbitrary web scripts into pages.

These injected scripts execute whenever any user accesses the affected page, potentially compromising user security.

The exploit works even if the attacker lacks the unfiltered_html capability because the malicious payload can be crafted without HTML angle brackets, bypassing Elementor's wp_kses_post() filter.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers with contributor-level access to inject malicious scripts into web pages.

When users visit these compromised pages, the malicious scripts execute in their browsers, which can lead to theft of sensitive information, session hijacking, or other malicious actions.

Because the attack requires only contributor-level access, it increases the risk from insider threats or compromised accounts with limited privileges.

Overall, this can lead to a loss of user trust, data breaches, and potential damage to the website's reputation.

Useful 0 Not Useful 0