CVE-2024-10453

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Typography Settings in all versions up to, and including, 3.25.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
elemntorElementor Website Builder – more than just a page builder<= 3.25.9

References

Timeline

Published
Dec 21, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-104546.1Clickjacking vulnerability in Clibo Manager v1.1.9.12 in the '/public/login' directory, a login panel. This vulnerability occurs due to the CVE-2024-104557.5Reachable Assertion in BPv7 parser in µD3TN v0.14.0 allows attacker to disrupt service via malformed Extension BlockCVE-2024-104569.8Delta Electronics InfraSuite Device Master versions prior to 1.0.12 are affected by a deserialization vulnerability that targets the Device-CVE-2024-104576.5Multiple Server-Side Request Forgery (SSRF) vulnerabilities were identified in the significant-gravitas/autogpt repository, specifically in CVE-2024-104587.5A permission leak could have occurred from a trusted site to an untrusted site via `embed` or `object` elements. This vulnerability affects CVE-2024-104597.5An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentially exploitable crash. This vulnerabilitCVE-2024-10465.4The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPreCVE-2024-104605.3The origin of an external protocol handler prompt could have been obscured using a data: URL within an `iframe`. This vulnerability affects CVE-2024-104616.1In multipart/x-mixed-replace responses, `Content-Disposition: attachment` in the response header was not respected and did not force a downlCVE-2024-104626.5Truncation of a long URL could have allowed origin spoofing in a permission prompt. This vulnerability affects Firefox < 132, Firefox ESR < CVE-2024-104636.5Video frames could have been leaked between origins in some situations. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, FirefCVE-2024-104646.5Repeated writes to history interface attributes could have been used to cause a Denial of Service condition in the browser. This was address