WordPress Elementor Addons Vulnerability Impacts 400k Websites

Wordfence issued an advisory on a vulnerability patched within the common Comfortable Addons for Elementor plugin, put in on over 400,000 web sites. The safety flaw may enable attackers to add malicious scripts that execute when browsers go to affected pages.

Comfortable Addons for Elementor

The Comfortable Addons for Elementor plugin extends the Elementor web page builder with dozens of free widgets and options like picture grids, a consumer suggestions and opinions operate, and customized navigation menus. A paid model of the plugin presents much more design functionalities that make it simple to create useful and engaging WordPress web sites.

Saved Cross-Web site Scripting (Saved XSS)

Saved XSS is a vulnerability sometimes happen when a theme or plugin doesn’t correctly filter consumer inputs (referred to as sanitization), permitting malicious scripts to be uploaded to the database and saved on the server itself. When a consumer visits the web site the script downloads to the browser and executes actions like stealing browser cookies or redirecting the consumer to a malicious web site.

The saved XSS vulnerability affecting the Comfortable Addons for Elementor plugin requires a hacker buying Contributor-level permissions (authentication), making it tougher to benefit from the vulnerability.

WordPress safety firm Wordfence rated the vulnerability 6.4 on a scale of 1 – 10, a medium menace degree.

In accordance Wordfence:

“The Comfortable Addons for Elementor plugin for WordPress is susceptible to Saved Cross-Web site Scripting through the before_label parameter within the Picture Comparability widget in all variations as much as, and together with, 3.12.5 because of inadequate enter sanitization and output escaping. This makes it potential for authenticated attackers, with Contributor-level entry and above, to inject arbitrary internet scripts in pages that may execute at any time when a consumer accesses an injected web page.”

Plugin customers ought to contemplate updating to the most recent model, presently 3.12.6, which incorporates a safety patch for the vulnerability.

Learn the Wordfence advisory:

Comfortable Addons for Elementor <= 3.12.5 – Authenticated (Contributor+) Saved Cross-Web site Scripting through Picture Comparability

Featured Picture by Shutterstock/Crimson Cristal