CVE-2024-37922 in Premium Addons for Elementor Plugin
Summary
by MITRE • 07/20/2024
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor.This issue affects Premium Addons for Elementor: from n/a through <= 4.10.34.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 04/02/2026
The vulnerability identified as CVE-2024-37922 represents a critical cross-site scripting flaw within the Leap13 Premium Addons for Elementor plugin, specifically impacting versions ranging from the initial release through version 4.10.34. This weakness falls under the category of improper input neutralization during web page generation, creating a pathway for malicious actors to inject harmful scripts into web applications. The vulnerability stems from inadequate sanitization of user-supplied data that gets processed and rendered within the plugin's web interface components, potentially allowing attackers to execute arbitrary JavaScript code in the context of a victim's browser session.
The technical nature of this flaw aligns with CWE-79, which specifically addresses cross-site scripting vulnerabilities where input data is not properly escaped or validated before being incorporated into web pages. The vulnerability occurs when the plugin fails to adequately sanitize parameters or content that users can provide through various interface elements, form fields, or API endpoints. Attackers can exploit this weakness by crafting malicious input that, when processed by the plugin, gets embedded into generated web pages without proper encoding or filtering mechanisms. This allows for the execution of malicious scripts that can steal session cookies, redirect users to malicious sites, or perform actions on behalf of authenticated users.
The operational impact of this vulnerability extends beyond simple script execution, as it can enable sophisticated attack vectors including session hijacking, data theft, and unauthorized administrative actions within the compromised WordPress environment. When exploited successfully, the XSS vulnerability could allow attackers to gain persistent access to user accounts, manipulate content displayed on the website, or even escalate privileges if the targeted users have administrative capabilities. The affected plugin's integration with Elementor's page builder interface creates multiple potential attack surfaces where malicious input can be injected through various content creation and management functions.
Security professionals should consider this vulnerability in the context of the ATT&CK framework under the technique T1566, specifically focusing on the initial access phase where adversaries leverage web application vulnerabilities to establish footholds. The vulnerability's impact is particularly concerning given that Elementor is widely used for website creation and management, meaning that compromised sites could serve as launching points for broader attacks against visitors or other connected systems. Organizations should prioritize immediate remediation efforts, as the vulnerability affects a broad range of installations and could be actively exploited in the wild. The recommended mitigation strategy involves upgrading to the latest version of the plugin where the XSS vulnerability has been addressed through proper input sanitization and output encoding mechanisms.
The remediation process requires administrators to update the Premium Addons for Elementor plugin to a version that implements proper input validation and output escaping techniques. This includes implementing comprehensive sanitization of all user inputs before they are processed or rendered within web pages, utilizing appropriate encoding methods such as HTML entity encoding for output, and implementing Content Security Policy headers to add additional layers of protection against script execution. Security teams should also conduct thorough vulnerability assessments of their WordPress installations to identify any other potentially affected plugins or themes that might present similar input handling weaknesses, as this type of vulnerability often indicates broader architectural issues within the application's data handling processes.