CVE-2024-47630 in Addons for Elementor Plugin
Summary
by MITRE • 10/05/2024
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows Stored XSS.This issue affects ElementInvader Addons for Elementor: from n/a through <= 1.2.7.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/05/2026
The CVE-2024-47630 vulnerability represents a critical cross-site scripting flaw in the Element Invader ElementInvader Addons for Elementor plugin, which operates under the CWE-79 category for improper neutralization of input during web page generation. This vulnerability enables attackers to inject malicious scripts into web pages viewed by other users, creating a persistent security risk within WordPress environments that utilize the Elementor page builder platform. The flaw specifically manifests as a stored XSS vulnerability, meaning that malicious payloads are permanently stored on the server and executed whenever affected pages are accessed, rather than requiring immediate user interaction with a crafted link.
The technical implementation of this vulnerability stems from insufficient input validation and output escaping mechanisms within the plugin's codebase, particularly in how it processes user-supplied data for display in web pages. Attackers can exploit this weakness by submitting malicious script content through plugin forms or settings interfaces, which are then stored in the database and subsequently rendered in web pages without proper sanitization. This allows threat actors to execute arbitrary JavaScript code in the context of other users' browsers, potentially enabling session hijacking, credential theft, or redirection to malicious sites. The vulnerability affects all versions of the ElementInvader Addons for Elementor plugin up to and including version 1.2.7, indicating that the flaw has existed for some time without proper mitigation.
The operational impact of this vulnerability extends beyond simple script execution, as it can be leveraged for broader attacks within compromised WordPress environments. Attackers can use the stored XSS to establish persistent backdoors, harvest user credentials, or manipulate content displayed to authenticated users. This vulnerability particularly threatens websites that rely heavily on Elementor for page construction, as it provides attackers with a direct vector to compromise user sessions and potentially escalate privileges within the WordPress administration interface. The stored nature of the vulnerability means that even users who do not directly interact with malicious links can be affected, as the scripts execute automatically when pages are loaded, creating a widespread impact across the user base.
Organizations affected by this vulnerability should immediately implement mitigations including updating to the latest version of the ElementInvader Addons for Elementor plugin where the XSS flaw has been patched, applying temporary workarounds such as restricting user permissions for plugin settings, and implementing content security policies to limit script execution. The ATT&CK framework categorizes this vulnerability under technique T1548.003 for Abuse of Cloud Infrastructure and T1059.007 for Command and Scripting Interpreter, highlighting the potential for attackers to leverage this weakness for further compromise. Additional defensive measures should include monitoring for unusual plugin activity, implementing web application firewalls to detect and block XSS attempts, and conducting regular security audits of third-party plugins to identify similar vulnerabilities. System administrators should also consider implementing proper input sanitization practices and output encoding throughout their WordPress environments to reduce the attack surface for similar vulnerabilities.