CVE-2024-4379

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Global Tooltip widget in all versions up to, and including, 4.10.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 31, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-437905.5Vim is an open source command line text editor. When performing a search and displaying the search-count message is disabled (:set shm+=S), CVE-2024-437917.8RequestStore provides per-request global storage for Rack. The files published as part of request_store 1.3.2 have 0666 permissions, meaning CVE-2024-437926.1Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.17.0 of the Halo project. CVE-2024-437936.4Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.19.0 of the Halo project. CVE-2024-437946.1OpenSearch Dashboards Security Plugin adds a configuration management UI for the OpenSearch Security features to OpenSearch Dashboards. Impr CVE-2024-437956.1OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. The login functional CVE-2024-437964.7Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.red CVE-2024-437974.3audiobookshelf is a self-hosted audiobook and podcast server. A non-admin user is not allowed to create libraries (or access only the ones t CVE-2024-437988.6Chisel is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH. The Chisel server doesn't ever read the documented `AUTH` environme CVE-2024-437994.7Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() whi CVE-2024-438004.7serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted CVE-2024-438015.4Jellyfin is an open source self hosted media server. The Jellyfin user profile image upload accepts SVG files, allowing for a stored XSS att