CVE-2024-2121: 
WordPress vulnerability analysis and mitigation

The Elementor Website Builder Pro plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-2121) in the Media Carousel widget affecting all versions up to and including 3.20.1. The vulnerability stems from insufficient input sanitization and output escaping on user supplied attributes (NVD).

The vulnerability exists due to insufficient input sanitization and output escaping on user supplied attributes in the Media Carousel widget. This allows authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts into pages that will execute whenever a user accesses the injected page. The issue was addressed in version 3.20.2 of the plugin (Elementor Changelog).

The vulnerability allows authenticated attackers with contributor-level or higher permissions to inject arbitrary web scripts into pages. When users access these compromised pages, the injected scripts will execute in their browsers, potentially leading to session hijacking, credential theft, or other client-side attacks. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.4 (Medium) (NVD).

The vulnerability requires an authenticated user with contributor-level or higher permissions to exploit. The attacker needs to have access to the Media Carousel widget to inject malicious scripts that will then execute when other users view the affected pages (NVD).

Users should update to Elementor Website Builder Pro version 3.20.2 or later which contains security fixes for the Media Carousel widget. The update includes improved code security enforcement to address the vulnerability (Elementor Changelog).