CVE-2024-5092

Summary

CVE-2024-5092 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Elegant Addons plugin for WordPress. The issue lies in the Switcher, Slider, and Iconbox widgets, which fail to properly sanitize and escape user-supplied attributes. Consequently, authenticated attackers with contributor-level access or higher can inject malicious web scripts into pages. These scripts will execute whenever an unsuspecting user accesses the manipulated pages.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.