CVE-2024-3647

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's post ticker widget in all versions up to, and including, 4.10.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the premium version of the plugin to be installed and activated in order to be exploited.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 2, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-364709.8In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific edge cases CVE-2024-364717.5Import functionality is vulnerable to DNS rebinding attacks between verification and processing of the URL. Project administrators can run CVE-2024-364726.5In GNOME Shell through 45.7, a portal helper can be launched automatically (without user confirmation) based on network responses provided b CVE-2024-364735.3Trend Micro VPN Proxy One Pro, version 5.8.1012 and below is vulnerable to an arbitrary file overwrite or create attack but is limited to lo CVE-2024-364747.8An integer overflow vulnerability exists in the Compound Document Binary File format parser of the GNOME Project G Structured File Library (CVE-2024-364758.8FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd. contain an active debug code vulnerability. If a user CVE-2024-364765.5In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Ensure 'ib_sge list' is accessible Move the declaration of CVE-2024-364777.8In the Linux kernel, the following vulnerability has been resolved: tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer CVE-2024-364785.5In the Linux kernel, the following vulnerability has been resolved: null_blk: fix null-ptr-dereference while configuring 'power' and 'submi CVE-2024-364795.5In the Linux kernel, the following vulnerability has been resolved: fpga: bridge: add owner module and take its refcount The current imple CVE-2024-36485.4The ShareThis Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sharethis-inline-button' sho CVE-2024-364809.8Use of hard-coded credentials issue exists in Ricoh Streamline NX PC Client ver.3.7.2 and earlier. If this vulnerability is exploited, an at