CVE-2024-2618

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the size attribute in all versions up to, and including, 1.6.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-87CWE-79

Affected software

No affected versions have been published.

Timeline

Published
May 24, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-261808.0Secure Boot Security Feature Bypass VulnerabilityCVE-2024-261815.5Windows Kernel Denial of Service VulnerabilityCVE-2024-261827.8Windows Kernel Elevation of Privilege VulnerabilityCVE-2024-261836.5Windows Kerberos Denial of Service VulnerabilityCVE-2024-261846.8Secure Boot Security Feature Bypass VulnerabilityCVE-2024-261856.5Windows Compressed Folder Tampering VulnerabilityCVE-2024-261868.8Microsoft SQL Server Native Scoring Remote Code Execution VulnerabilityCVE-2024-261884.3Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2024-261898.0Secure Boot Security Feature Bypass VulnerabilityCVE-2024-26195.4The Elementor Header & Footer Builder for WordPress is vulnerable to HTML Injection in all versions up to, and including, 1.6.26 due to insuCVE-2024-261907.5Microsoft QUIC Denial of Service VulnerabilityCVE-2024-261918.8Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
CVE-2024-2618: Medium severity, CVSS 5.4 | Vulnix