CVE-2024-8742

Essential Addons for Elementor <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery Widget

The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Filterable Gallery widget in all versions up to, and including, 6.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

We have discovered 83,416 live websites that are affected by CVE-2024-8742.

Test my site



Affected Software

Product  Essential Addons for Elementor
Category Wordpress Plugins
Vulnerable Domains83,416 live websites (29.30% of Essential Addons for Elementor install base)
Vulnerable Versions
  • from 0 through 6.0.3
Vulnerable Versions Count184 versions ( 89.32% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Sep 13, 2024
  • Updated - Sep 13, 2024

Credits

  • D.Sim (finder)

CVE-2024-8742 usage by Country

United States27,584 websites


Germany10,219 websites
France5,432 websites
Cyprus3,772 websites
GB2,995 websites
Brazil2,884 websites
Spain2,317 websites
Poland2,227 websites
Italy1,640 websites
Netherlands1,517 websites

CVE-2024-8742 usage by TLD

.com33,697 websites
.com.br4,149 websites
.org3,685 websites
.de3,547 websites
.ru2,667 websites
.co.uk1,945 websites
.fr1,916 websites
.pl1,742 websites
.net1,568 websites
.nl1,441 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2024-8742

Top websites that are affected by CVE-2024-8742. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
***.cz Czech Republic*,***
******.com United States*,***
**********.com United States**,***
*******.co Germany**,***
*******.com United States**,***
***.ai United States**,***
********.net United States**,***
********.org GB**,***
****.com United States**,***
************.com United States**,***
See full domain list

FAQ

CVE-2024-8742 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Essential Addons for Elementor
A total of 83,416 websites have been identified as vulnerable to CVE-2024-8742, discovered through global website indexing conducted by WebTechSurvey.
Essential Addons for Elementor is susceptible to CVE-2024-8742 vulnerability.
Essential Addons for Elementor versions before, and including, 6.0.3 are vulnerable to CVE-2024-8742.