CVE-2024-2091 in Elementor Addon Elements Plugin
Summary
by MITRE • 03/28/2024
The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 1.13.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/13/2026
The vulnerability identified as CVE-2024-2091 affects the Elementor Addon Elements plugin for WordPress, specifically targeting versions up to and including 1.13.2. This represents a critical security flaw that undermines the integrity of WordPress websites utilizing this plugin. The vulnerability stems from inadequate input sanitization and output escaping mechanisms within the plugin's widget functionality, creating an environment where malicious scripts can be persistently stored and executed. Attackers exploiting this weakness can leverage their privileges to inject harmful code that remains embedded within the website's content until manually removed.
The technical nature of this vulnerability places it squarely within the category of stored cross-site scripting attacks, which are classified under CWE-00000079 in the Common Weakness Enumeration system. This flaw allows authenticated attackers who possess contributor-level permissions or higher to manipulate the plugin's widgets and inject malicious JavaScript code into pages. The stored nature of the vulnerability means that once the malicious payload is injected, it persists in the database and executes automatically whenever any user accesses the compromised page, making it particularly dangerous for widespread impact. The vulnerability specifically targets user-supplied attributes within the plugin's widget system, where insufficient validation allows attackers to bypass security controls.
The operational impact of CVE-2024-2091 extends beyond simple script injection, as it creates a persistent backdoor for attackers to execute malicious activities. When victims access pages containing the stored malicious code, the scripts execute in the context of the victim's browser, potentially leading to session hijacking, credential theft, or redirection to malicious sites. This vulnerability directly violates the principle of least privilege and can be exploited to escalate attacks within compromised WordPress environments. The attack vector leverages the trusted relationship between the legitimate plugin and the WordPress installation, making detection more challenging for security monitoring systems. Organizations running affected versions of the Elementor Addon Elements plugin face significant risk of unauthorized access, data breaches, and potential compromise of entire WordPress installations.
Mitigation strategies for CVE-2024-2091 require immediate action to address the root cause through proper input validation and output escaping mechanisms. The primary recommendation involves upgrading to the latest version of the Elementor Addon Elements plugin where the vulnerability has been patched, as this resolves the underlying sanitization issues. Additionally, administrators should implement strict role-based access controls to limit contributor-level permissions to trusted users only, reducing the attack surface for privilege escalation. Security monitoring should include regular scanning of plugin files for unauthorized modifications and implementation of web application firewalls to detect and block malicious script execution attempts. The vulnerability also highlights the importance of adhering to secure coding practices as outlined in the OWASP Top Ten security standards, particularly focusing on input validation and output encoding to prevent cross-site scripting attacks. Organizations should conduct thorough security audits of their WordPress installations to identify and remediate similar vulnerabilities across other plugins and themes, as this represents a systemic issue in plugin security practices that requires comprehensive addressing through proper security hardening measures.