Plus Addons for Elementor Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the Plus Addons for Elementor WordPress plugin, affecting versions prior to 6.3.16. The issue arises because the plugin does not properly sanitize the contents of SVG files, allowing users with at least Author role access to inject XSS payloads that are subsequently stored and executed.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the content.

Reproduction

To reproduce this vulnerability, upload an SVG file containing a script payload, such as a JavaScript alert, to the Media Library. After the file is uploaded, it can be accessed via its URL, where the injected script will execute, demonstrating the cross-site scripting vulnerability.

Remediation

Users are advised to update the Plus Addons for Elementor WordPress plugin to version 6.3.16 or later.