UpHeron
All vulnerabilities

Servers and applications · WordPress plugins

CVE-2024-4619

Elementor Website Builder – more than just a page builder: Cross-site Scripting

Severity
Medium 5.4
Published
20 May 2024
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
3.21.5, 3.22.0-beta2
Also known as
WPV-d01d6af76741
Sources
NVD, WPVulnerability

Description

The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘hover_animation’ parameter in versions up to, and including, 3.21.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web…

Affected software

SoftwareAffected versions
ElementorServers and applications · cpe:a:elementor:website_builder
  • Every version before 3.21.5
ElementorWordPress plugins · wp-plugin:elementor
  • Every version before 3.22.0-beta2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-4619
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-4619
  • Wordfence https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/elementor/elementor-website-builder-more-than-just-a-page-builder-3214-authenticated-contributor-dom-based-stored-cross-site-scripting