VYPR
← All advisories
Medium severity6.4NVD Advisory· Published Jul 18, 2024· Updated Apr 8, 2026

CVE-2024-5554

CVE-2024-5554

Description

The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘onclick_event’ parameter in all versions up to, and including, 5.6.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-39667 is likely a duplicate of this issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Bdthemes/Element Pack2 versions
    cpe:2.3:a:bdthemes:element_pack:*:*:*:*:lite:wordpress:*:*+ 1 more
    • cpe:2.3:a:bdthemes:element_pack:*:*:*:*:lite:wordpress:*:*range: <5.6.12
    • (no CPE)range: <=5.6.11
  • WordPress/Element Packwp-canonicalize

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.