CVE-2024-8961

Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘nomore_items_text’ parameter in all versions up to, and including, 6.0.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

We have discovered 100,784 live websites that are affected by CVE-2024-8961.

Test my site



Affected Software

Product  Essential Addons for Elementor
Category Wordpress Plugins
Vulnerable Domains100,784 live websites (35.41% of Essential Addons for Elementor install base)
Vulnerable Versions
  • from 0 through 6.0.7
Vulnerable Versions Count188 versions ( 91.26% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Nov 15, 2024
  • Updated - Nov 15, 2024

Credits

  • D.Sim (finder)

CVE-2024-8961 usage by Country

United States34,283 websites


Germany12,216 websites
France6,546 websites
Cyprus4,554 websites
GB3,552 websites
Brazil3,348 websites
Spain2,769 websites
Poland2,662 websites
Italy1,964 websites
Netherlands1,802 websites

CVE-2024-8961 usage by TLD

.com41,277 websites
.com.br4,856 websites
.org4,591 websites
.de4,251 websites
.ru2,823 websites
.co.uk2,377 websites
.fr2,344 websites
.pl2,089 websites
.net1,915 websites
.com.au1,765 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2024-8961

Top websites that are affected by CVE-2024-8961. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
***.cz Czech Republic*,***
******.com United States*,***
**********.com United States**,***
*******.co Germany**,***
**********.com United States**,***
*************.org United States**,***
*******.com United States**,***
***.ai United States**,***
********.net United States**,***
********.com United States**,***
See full domain list

FAQ

CVE-2024-8961 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Essential Addons for Elementor
A total of 100,784 websites have been identified as vulnerable to CVE-2024-8961, discovered through global website indexing conducted by WebTechSurvey.
Essential Addons for Elementor is susceptible to CVE-2024-8961 vulnerability.
Essential Addons for Elementor versions before, and including, 6.0.7 are vulnerable to CVE-2024-8961.