CVE-2024-2619

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Elementor Header & Footer Builder for WordPress is vulnerable to HTML Injection in all versions up to, and including, 1.6.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level permissions and above, to inject arbitrary HTML in pages that will be shown whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-862CWE-79

Affected software

No affected versions have been published.

Timeline

Published
May 16, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-261907.5Microsoft QUIC Denial of Service VulnerabilityCVE-2024-261918.8Microsoft SQL Server Native Scoring Remote Code Execution VulnerabilityCVE-2024-261928.2Microsoft Edge (Chromium-based) Information Disclosure VulnerabilityCVE-2024-261936.4Azure Migrate Remote Code Execution VulnerabilityCVE-2024-261947.4Secure Boot Security Feature Bypass VulnerabilityCVE-2024-261957.2DHCP Server Service Remote Code Execution VulnerabilityCVE-2024-261964.3Microsoft Edge for Android (Chromium-based) Information Disclosure VulnerabilityCVE-2024-261976.5Windows Standards-Based Storage Management Service Denial of Service VulnerabilityCVE-2024-261988.8Microsoft Exchange Server Remote Code Execution VulnerabilityCVE-2024-261997.8Microsoft Office Elevation of Privilege VulnerabilityCVE-2024-26209.8A vulnerability has been found in Fujian Kelixin Communication Command and Dispatch Platform up to 20240318 and classified as critical. AffeCVE-2024-262008.8Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2024-2619: Medium severity, CVSS 5.4 | Vulnix