Elementor Website Builder – More than Just a Page Builder, CVE-2020-36703

CVE, Research URL: CVE-2020-36703
Home page URL: Security reports for Elementor Website Builder – More than Just a Page Builder
Application: Elementor Website Builder – More than Just a Page Builder
Published on: Jun 07, 2023
Research Description: The Elementor Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG image uploads in versions up to, and including 2.9.7 This makes it possible for authenticated attackers with the upload_files capability to inject arbitrary web scripts in pages that will execute whenever a user accesses the page with the stored web scripts.
Affected versions: max 2.9.8.
Status: vulnerable