The Ultimate Bootstrap Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘heading_title_tag’ and ’heading_sub_title_tag’ parameters in all versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| G5plus |
|
Configuration 1 [-]
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2024-17154 | The Ultimate Bootstrap Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘heading_title_tag’ and ’heading_sub_title_tag’ parameters in all versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 08 Jan 2025 19:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
G5plus
G5plus ultimate Bootstrap Elements For Elementor |
|
| Weaknesses | CWE-79 | |
| CPEs | cpe:2.3:a:g5plus:ultimate_bootstrap_elements_for_elementor:*:*:*:*:*:wordpress:*:* | |
| Vendors & Products |
G5plus
G5plus ultimate Bootstrap Elements For Elementor |
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published:
Updated: 2024-08-01T18:40:20.900Z
Reserved: 2024-02-09T14:11:33.298Z
Link: CVE-2024-1398
Vulnrichment
Updated: 2024-08-01T18:40:20.900Z
NVD
Status : Analyzed
Published: 2024-03-02T13:15:06.890
Modified: 2025-01-08T18:39:21.643
Link: CVE-2024-1398
Redhat
No data.
OpenCVE Enrichment
No data.