Elementor Addon Elements <= 1.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via id and eae_slider_animation Parameters

Vulnerability

The Elementor Addon Elements plugin for WordPress (versions up to and including 1.13.5) is susceptible to Stored Cross-Site Scripting (XSS) via the 'id' and 'eae_slider_animation' parameters. Insufficient input sanitization and output escaping allow arbitrary script injection. The plugin is available on the WordPress plugin repository and includes over 40 widgets for Elementor [1].

Exploitation

An authenticated attacker with at least Contributor-level access can inject malicious scripts through the affected parameters. The crafted payload is stored on the server and triggers when any user, including administrators, visits the compromised page. No additional chaining of vulnerabilities is required beyond standard WordPress post editing capabilities.

Impact

Successful exploitation enables the attacker to execute arbitrary web scripts in the context of the victim's browser. This can lead to session hijacking, defacement, or redirection to malicious sites, compromising the confidentiality and integrity of the WordPress site and its users.

Mitigation

The plugin maintainer released version 1.14.5, which fixes the vulnerability. Users are urged to update to this or any later version. The latest tested WordPress version is 6.9.4 [1]. No workaround is available for unpatched installations; immediate update is recommended.