Elementor Website Builder – More than Just a Page Builder, 0dae9b941890def7a8bbbdf28e93159a1ae10b31

CVE, Research URL: 0dae9b941890def7a8bbbdf28e93159a1ae10b31
Home page URL: Security reports for Elementor Website Builder – More than Just a Page Builder
Application: Elementor Website Builder – More than Just a Page Builder
Published on: Apr 21, 2020
Research Description: Elementor Website Builder – more than just a page builder [elementor] < 2.9.8 Elementor Website Builder <= 2.9.7 - Authenticated Stored Cross-Site Scripting The Elementor Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG image uploads in versions up to, and including 2.9.7 This makes it possible for authenticated attackers with the upload_files capability to inject arbitrary web scripts in pages that will execute whenever a user accesses the page with the stored web scripts.
Affected versions: max 2.9.8.
Status: vulnerable