CVE-2024-4376

Premium Addons for Elementor <= 4.10.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget

The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Fancy Text widget in all versions up to, and including, 4.10.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. While 4.10.32 is patched, it is recommended to update to 4.10.33 because 4.10.32 caused a fatal error.

We have discovered 28,765 live websites that are affected by CVE-2024-4376.

Test my site



Affected Software

Product  Premium Addons for Elementor
Category Wordpress Plugins
Vulnerable Domains28,765 live websites (24.45% of Premium Addons for Elementor install base)
Vulnerable Versions
  • from 0 through 4.10.31
Vulnerable Versions Count378 versions ( 87.10% of all versions)



Details

  • Published - May 31, 2024
  • Updated - Aug 1, 2024

Credits

  • Craig Smith (finder)

CVE-2024-4376 usage by Country

United States8,971 websites


Germany3,528 websites
France1,869 websites
Cyprus1,106 websites
Russia1,042 websites
GB1,005 websites
Brazil1,004 websites
Poland971 websites
Spain740 websites
Italy632 websites

CVE-2024-4376 usage by TLD

.com11,748 websites
.com.br1,473 websites
.de1,285 websites
.org1,038 websites
.ru812 websites
.pl782 websites
.co.uk672 websites
.fr664 websites
.it554 websites
.nl532 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2024-4376

Top websites that are affected by CVE-2024-4376. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
***********.com United States*,***
*********.com United States**,***
*******************.es Spain**,***
***********.com United States**,***
*******.org United States**,***
*********.com United Arab Emirates**,***
**************.com United States**,***
********.**.il Israel**,***
*********.**.th United States**,***
******.org United States**,***
See full domain list

FAQ

A total of 28,765 websites have been identified as vulnerable to CVE-2024-4376, discovered through global website indexing conducted by WebTechSurvey.
Premium Addons for Elementor is susceptible to CVE-2024-4376 vulnerability.
Premium Addons for Elementor versions before, and including, 4.10.31 are vulnerable to CVE-2024-4376.