CVE-2024-4203

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Premium Addons Pro for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the maps widget in all versions up to, and including, 4.10.30 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Please note this only affects sites running the premium version of the plugin.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
May 2, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-420306.2Access permission verification vulnerability in the content sharing pop-up module Impact: Successful exploitation of this vulnerability may CVE-2024-420317.5Access permission verification vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect servicCVE-2024-420325.5Access permission verification vulnerability in the Contacts module Impact: Successful exploitation of this vulnerability may affect serviceCVE-2024-420337.1Access control vulnerability in the security verification module mpact: Successful exploitation of this vulnerability will affect integrity CVE-2024-420345.5LaunchAnywhere vulnerability in the account module. Impact: Successful exploitation of this vulnerability may affect service confidentialityCVE-2024-420357.8Permission control vulnerability in the App Multiplier module Impact:Successful exploitation of this vulnerability may affect functionality CVE-2024-420367.5Access permission verification vulnerability in the Notepad module Impact: Successful exploitation of this vulnerability may affect service CVE-2024-420376.2Vulnerability of uncaught exceptions in the Graphics module Impact: Successful exploitation of this vulnerability may affect service confideCVE-2024-420387.8Vulnerability of PIN enhancement failures in the screen lock module Impact: Successful exploitation of this vulnerability may affect serviceCVE-2024-420397.5Access control vulnerability in the SystemUI module Impact: Successful exploitation of this vulnerability may affect service confidentialityCVE-2024-42044.3The Bulk Posts Editing For WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, CVE-2024-420408.1Buffer Overflow vulnerability in the net/bootp.c in DENEX U-Boot from its initial commit in 2002 (3861aa5) up to today on any platform allow
CVE-2024-4203: Medium severity, CVSS 5.4 | Vulnix