CVE-2024-2131

Summary

CVE-2024-2131 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Move Addons for Elementor plugin for WordPress. The issue lies in the infobox and button widget, which fail to properly sanitize and escape user-supplied attributes. This flaw enables authenticated attackers with contributor-level access or higher to inject malicious scripts. These scripts are executed whenever a user visits an injected page, posing a serious security risk. All versions of the plugin up to and including 1.2.9 are impacted.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.