The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' and 'slide_id' parameters in all versions up to, and including, 2.6.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Metrics
Affected Vendors & Products
References
History
Fri, 13 Sep 2024 15:00:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Crocoblock
Crocoblock jetelements |
|
CPEs | cpe:2.3:a:crocoblock:jetelements:*:*:*:*:*:wordpress:*:* | |
Vendors & Products |
Crocoblock
Crocoblock jetelements |
Wed, 28 Aug 2024 21:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
Fri, 16 Aug 2024 14:00:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' and 'slide_id' parameters in all versions up to, and including, 2.6.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |
Title | JetElements <= 2.6.20 - Authenticated (Contributor+) Stored Cross-Site Scripting | |
Weaknesses | CWE-79 | |
References |
| |
Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published: 2024-08-16T13:48:56.685Z
Updated: 2024-09-13T14:05:07.500Z
Reserved: 2024-07-26T19:12:44.049Z
Link: CVE-2024-7144
Vulnrichment
Updated: 2024-08-28T21:01:39.093Z
NVD
Status : Analyzed
Published: 2024-08-16T14:15:14.690
Modified: 2024-09-13T14:40:14.420
Link: CVE-2024-7144
Redhat
No data.