CVE-2021-24351 The Plus Addons for Elementor < 4.1.12 - Reflected Cross-Site Scripting (XSS)

What is CVE-2021-24351?

CVE-2021-24351 is a medium-severity cross-site scripting vulnerability in Unknown The Plus Addons for Elementor Page Builder, published on 14 Jun 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.12 did not properly sanitise some of its fields, leading to a reflected Cross-Site Scripting (exploitable on both unauthenticated and authenticated users)

Weakness: CWE-79

Which versions are affected by CVE-2021-24351?

It affects 1 product.

Products include Posimyth the Plus Addons for Elementor.

How do I fix CVE-2021-24351?

No fix has been published for CVE-2021-24351 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-24351 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-24351 exists.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in Unknown The Plus Addons for Elementor Page Builder

• CVE-2021-24949 The Plus Addons for Elementor Pro < 5.0.7 - Unauthenticated SQL Injection Critical 9.8
• CVE-2021-24175 The Plus Addons for Elementor Page Builder < 4.1.7 - Authentication Bypass Critical 9.8
• CVE-2024-5455 Path traversal in The Plus Addons for Elementor Page Builder Pro High 8.8
• CVE-2021-4331 Privilege escalation in The Plus Addons for Elementor Page Builder Pro High 8.8
• CVE-2023-47178 WordPress The Plus Addons for Elementor Pro plugin <= 5.2.8 - Unauthenticated Local File Inclusion vulnerability High 8.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-335g-mg6r-4m22.