Vulnerability DatabaseCVE-2024-33539

CVE-2024-33539:
WordPress vulnerability analysis and mitigation

Overview

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in WPZOOM Addons for Elementor (Templates, Widgets) WordPress plugin, affecting versions up to and including 1.1.35. The vulnerability was identified and reported by security researcher Khalid on March 26, 2024, and was assigned CVE-2024-33539 (Patchstack).

Technical details

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79) with a CVSS v3.1 base score of 5.4 (Medium) according to NVD, while Patchstack rates it at 6.5 (Medium). The vulnerability vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating it requires low attack complexity but needs user interaction and privileged access (NVD).

Impact

The vulnerability allows authenticated attackers with contributor-level access or higher to inject malicious scripts into web pages. When executed, these scripts can potentially lead to various attacks including redirects, unauthorized advertisements, and other malicious HTML payloads that execute when visitors access the affected site (Patchstack).

Mitigation and workarounds

The vulnerability has been fixed in version 1.1.36 of the WPZOOM Addons for Elementor plugin. Users are advised to update to version 1.1.36 or later to remove the vulnerability. Patchstack users can enable auto-update functionality for vulnerable plugins (Patchstack).