CVE-2024-4342

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's image hotspot, image accordion, off canvas, woogrid, and product mini cart widgets in all versions up to, and including, 1.3.975 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 1, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-434205.6Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution for some Intel Ato CVE-2024-434239.8The web application for ProGauge MAGLINK LX4 CONSOLE contains an administrative-level user account with a password that cannot be changed.CVE-2024-434247.5Sharp and Toshiba Tec MFPs improperly process HTTP request headers, resulting in an Out-of-bounds Read vulnerability. Crafted HTTP requests CVE-2024-434258.1A flaw was found in Moodle. Additional restrictions are required to avoid a remote code execution risk in calculated question types. Note: T CVE-2024-434267.5A flaw was found in pdfTeX. Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX CVE-2024-434273.7A flaw was found in moodle. When creating an export of site administration presets, some sensitive secrets and keys are not being excluded f CVE-2024-434287.1To address a cache poisoning risk in Moodle, additional validation for local storage was required.CVE-2024-434295.3A flaw was found in moodle. Some hidden user profile fields are visible in gradebook reports, which could result in users without the "view CVE-2024-43439.8A Python command injection vulnerability exists in the `SagemakerLLM` class's `complete()` method within `./private_gpt/components/llm/custo CVE-2024-434305.3A flaw was found in moodle. External API access to Quiz can override contained insufficient access control.CVE-2024-434317.5A vulnerability was found in Moodle. Insufficient capability checks made it possible to delete badges that a user does not have permission t CVE-2024-434325.3A flaw was found in moodle. The cURL wrapper in Moodle strips HTTPAUTH and USERPWD headers during emulated redirects, but retains other orig