Medium severity6.4NVD Advisory· Published May 14, 2024· Updated Apr 8, 2026

CVE-2024-4624

Description

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugins for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eael_ext_toc_title_tag’ parameter in versions up to, and including, 5.9.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Wpdeveloper/Essential Addons For Elementor
cpe:2.3:a:wpdeveloper:essential_addons_for_elementor:*:*:*:*:lite:wordpress:*:*
Range: <5.9.21
Wpdeveloper/Essential Addons For Elementor Litellm-fuzzy
Range: <=5.9.20
WordPress/Essential Addons For Elementor Litewp-canonicalize
Package: https://wordpress.org/plugins/essential-addons-for-elementor-lite

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changeset/3085420/nvdPatch
www.wordfence.com/threat-intel/vulnerabilities/id/bedad627-0ccb-41c1-be8d-753f57be618fnvdThird Party Advisory
plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/5.9.19/includes/Traits/Elements.phpnvdProduct

News mentions

No linked articles in our index yet.

cvss	0.416
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000