CVE-2024-2137

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple pricing widgets (e.g. Pricing Single, Pricing Icon, Pricing Tab) in all versions up to, and including, 2.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Apr 12, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-213708.8Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution VulnerabilityCVE-2024-213717.0Windows Kernel Elevation of Privilege VulnerabilityCVE-2024-213728.8Windows OLE Remote Code Execution VulnerabilityCVE-2024-213738.8SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityCVE-2024-213745.0Microsoft Teams for Android Information Disclosure VulnerabilityCVE-2024-213758.8Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution VulnerabilityCVE-2024-213769.0Microsoft Azure Kubernetes Service Confidential Container Remote Code Execution VulnerabilityCVE-2024-213775.5Windows DNS Information Disclosure VulnerabilityCVE-2024-213788.8Microsoft Outlook Remote Code Execution VulnerabilityCVE-2024-213797.8Microsoft Word Remote Code Execution VulnerabilityCVE-2024-21385.4The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Animated Box widget in all versions uCVE-2024-213808.0Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability
CVE-2024-2137: Medium severity, CVSS 5.4 | Vulnix