CVE-2024-3680

The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Animation Title widget's img tag in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Configurations

Configuration 1 (hide)

cpe:2.3:a:themelooks:enter_addons:*:*:*:*:*:wordpress:*:*

History

28 Jan 2025, 03:17

Type Values Removed Values Added
CWE CWE-79
References () https://wordpress.org/plugins/enteraddons/ - () https://wordpress.org/plugins/enteraddons/ - Product
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/29cc82cb-f3fd-4de5-9731-7ceb1212b0f9?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/29cc82cb-f3fd-4de5-9731-7ceb1212b0f9?source=cve - Third Party Advisory
CPE cpe:2.3:a:themelooks:enter_addons:*:*:*:*:*:wordpress:*:*
First Time Themelooks
Themelooks enter Addons

21 Nov 2024, 09:30

Type Values Removed Values Added
References () https://wordpress.org/plugins/enteraddons/ - () https://wordpress.org/plugins/enteraddons/ -
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/29cc82cb-f3fd-4de5-9731-7ceb1212b0f9?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/29cc82cb-f3fd-4de5-9731-7ceb1212b0f9?source=cve -

14 May 2024, 16:11

Type Values Removed Values Added
New CVE

Information

Published : 2024-05-14 15:42

Updated : 2025-01-28 03:17


NVD link : CVE-2024-3680

Mitre link : CVE-2024-3680

CVE.ORG link : CVE-2024-3680


JSON object : View

Products Affected

themelooks

  • enter_addons
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')