CVE-2024-2129mediumCWE-79

CVE-2024-2129: fallo de gravedad media en WPBITS Addons For Elementor Page Builder

WPBITS Addons For Elementor Page Builder <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear WPBITS Addons For Elementor Page Builder

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.4epss 0.4%
The WPBITS Addons For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's heading widget in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Productos afectados
wpbits · WPBITS Addons For Elementor Page Builder
CVEs relacionadas — WPBITS Addons For Elementor Page Builder

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-4862MEDIUMWPBITS Addons For Elementor Page Builder <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsEPSS 0.5%CVE-2022-4974MEDIUMFreemius SDK <= 2.4.2 - Missing Authorization ChecksEPSS 0.4%CVE-2024-56285MEDIUMWordPress WPBITS Addons For Elementor Page Builder plugin <= 1.5.1 - Cross-Site Scripting vulnerabilityEPSS 0.3%CVE-2024-8962MEDIUMWPBITS Addons For Elementor Page Builder <= 1.5.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2025-22316MEDIUMWordPress WPBITS Addons For Elementor Page Builder plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-9082MEDIUMWPBITS Addons For Elementor <= 1.8 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%