The Royal Elementor Addons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.3.59, due to due to insufficient input sanitization and output escaping of the 'wpr_ajax_search_link_target' parameter in the 'data_fetch' function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is occurring because 'sanitize_text_field' is insufficient to prevent attribute-based Cross-Site Scripting
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published: 2023-01-10T16:55:29.753Z
Updated: 2024-08-03T01:48:40.429Z
Reserved: 2022-12-23T18:52:34.443Z
Link: CVE-2022-4710
Vulnrichment
No data.
NVD
Status : Modified
Published: 2023-01-10T17:15:11.857
Modified: 2024-11-21T07:35:46.840
Link: CVE-2022-4710
Redhat
No data.