Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Accordion Widget
Vulnerability Description
In the Elementor Website Builder WordPress plugin before 3.1.4, the accordion widget (includes/widgets/accordion.php) accepts a ‘title_html_tag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘title_html_tag’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
CVSS Information
N/A
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Vulnerability Title
WordPress插件Elementor Website Builder 跨站脚本漏洞
Vulnerability Description
WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。Related Posts是使用在其中的一个关联内容添加插件。iframe是使用在其中的一个用于将另一个文档嵌入当前HTML文档中的内联框架。Elementor Page Builder是使用在其中的一个页面构建插件。Elementor是一款WordPress页面生成器，它提供多种设计元素，并支持自定义模板等。 WordPress插件Elementor Website Builder 3.1.4
CVSS Information
N/A
Vulnerability Type
N/A