CVE-2024-12120
Royal Elementor Addons and Templates <= 1.7.1017 - Authenticated (Contributor+) Stored Cross-Site Scripting
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown widget display_message_text parameter in all versions up to, and including, 1.7.1017 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
El complemento Royal Elementor Addons and Templates para WordPress es vulnerable a Cross-Site Scripting almacenado a través del parámetro display_message_text del widget Countdown en todas las versiones hasta la 1.7.1017 incluida, debido a una depuración de entrada y un escape de salida insuficientes. Esto permite a atacantes autenticados, con acceso de colaborador o superior, inyectar scripts web arbitrarios en páginas que se ejecutarán al acceder un usuario a una página inyectada.
CVSS Scores
SSVC
- Decision:Track
Timeline
- 2024-12-03 CVE Reserved
- 2025-05-06 CVE Published
- 2025-05-07 CVE Updated
- 2025-06-08 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (3)
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Wproyal Search vendor "Wproyal" | Royal Elementor Addons And Templates Search vendor "Wproyal" for product "Royal Elementor Addons And Templates" | <= 1.7.1017 Search vendor "Wproyal" for product "Royal Elementor Addons And Templates" and version " <= 1.7.1017" | en |
Affected
|