CVE-2024-4370

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget Image Box in all versions up to, and including, 1.1.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 15, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-437007.8xfpt versions prior to 1.01 fails to handle appropriately some parameters inside the input data, resulting in a stack-based buffer overflow CVE-2024-437017.8Software installed and run as a non-privileged user may conduct GPU system calls to read and write freed physical memory from the GPU.CVE-2024-437028.1Software installed and run as a non-privileged user may conduct improper GPU system calls to allow unprivileged access to arbitrary physical CVE-2024-437038.1Software installed and run as a non-privileged user may conduct improper GPU system calls to achieve unauthorised reads and writes of physic CVE-2024-437048.4Software installed and run as a non-privileged user may conduct improper GPU system calls to gain access to the graphics buffers of a parent CVE-2024-437057.8Software installed and run as a non-privileged user can trigger the GPU kernel driver to write to arbitrary read-only system files that have CVE-2024-437068.8Improper authorization in Kibana can lead to privilege abuse via a direct HTTP request to a Synthetic monitor endpoint.CVE-2024-437076.5An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive informat CVE-2024-437086.5An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of i CVE-2024-437097.5An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resulting in a crash via CVE-2024-43719.8The CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More plugin for WordPress is vulnerable to PH CVE-2024-437104.3A server side request forgery vulnerability was identified in Kibana where the /api/fleet/health_check API could be used to send requests to