CVE-2024-4339

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the General widget in all versions up to, and including, 3.14.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 14, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-433908.1A low privileged remote attacker can perform configuration changes of the firewall services, including packet forwarding or NAT through the CVE-2024-433918.1A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, net CVE-2024-433928.1A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, net CVE-2024-433938.1A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, net CVE-2024-433947.5Server-Side Request Forgery (SSRF) in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via mod_re CVE-2024-433958.2CraftOS-PC 2 is a rewrite of the desktop port of CraftOS from the popular Minecraft mod ComputerCraft using C++ and a modified version of PU CVE-2024-433965.4Khoj is an application that creates personal AI agents. The Automation feature allows a user to insert arbitrary HTML inside the task instru CVE-2024-433974.3Apollo is a configuration management system. A vulnerability exists in the synchronization configuration feature that allows users to craft CVE-2024-433985.9REXML is an XML toolkit for Ruby. The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that CVE-2024-433999.8Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dyna CVE-2024-43407.5Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.CVE-2024-434005.4XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible for a user without S