CVE-2021-24202 - Vulnerability Details - OpenCVE

In the Elementor Website Builder WordPress plugin before 3.1.4, the heading widget (includes/widgets/heading.php) accepts a ‘header_size’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request with this parameter set to ‘script’ and combined with a ‘title’ parameter containing JavaScript, which will then be executed when the saved page is viewed or previewed.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Elementor	Website Builder

Configuration 1 [-]

cpe:2.3:a:elementor:website_builder:*:*:*:*:*:wordpress:*:*

No data.

References

Link	Providers
https://wpscan.com/vulnerability/b72bd13d-c8e2-4347-b009-542fc0fe21bb
https://www.wordfence.com/blog/2021/03/cross-site-scripting-vulnerabilities-in-elementor-impact-over-7-million-sites/

History

No history.

MITRE

Status: PUBLISHED

Assigner: WPScan

Published: 2021-04-05T18:27:46

Updated: 2024-08-03T19:21:18.620Z

Reserved: 2021-01-14T00:00:00

Link: CVE-2021-24202

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-04-05T19:15:16.953

Modified: 2024-11-21T05:52:35.087

Link: CVE-2021-24202

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Elementor Website Builder", "vendor": "Unknown", "versions": [{"lessThan": "3.1.4", "status": "affected", "version": "3.1.4", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Ramuel Gall"}], "descriptions": [{"lang": "en", "value": "In the Elementor Website Builder WordPress plugin before 3.1.4, the heading widget (includes/widgets/heading.php) accepts a \u2018header_size\u2019 parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified \u2018save_builder\u2019 request with this parameter set to \u2018script\u2019 and combined with a \u2018title\u2019 parameter containing JavaScript, which will then be executed when the saved page is viewed or previewed."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Cross-site Scripting (XSS)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-04-05T18:27:46", "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.wordfence.com/blog/2021/03/cross-site-scripting-vulnerabilities-in-elementor-impact-over-7-million-sites/"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://wpscan.com/vulnerability/b72bd13d-c8e2-4347-b009-542fc0fe21bb"}], "source": {"discovery": "UNKNOWN"}, "title": "Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Heading Widget", "x_generator": "WPScan CVE Generator", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "contact@wpscan.com", "ID": "CVE-2021-24202", "STATE": "PUBLIC", "TITLE": "Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Heading Widget"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Elementor Website Builder", "version": {"version_data": [{"version_affected": "<", "version_name": "3.1.4", "version_value": "3.1.4"}]}}]}, "vendor_name": "Unknown"}]}}, "credit": [{"lang": "eng", "value": "Ramuel Gall"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In the Elementor Website Builder WordPress plugin before 3.1.4, the heading widget (includes/widgets/heading.php) accepts a \u2018header_size\u2019 parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified \u2018save_builder\u2019 request with this parameter set to \u2018script\u2019 and combined with a \u2018title\u2019 parameter containing JavaScript, which will then be executed when the saved page is viewed or previewed."}]}, "generator": "WPScan CVE Generator", "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79 Cross-site Scripting (XSS)"}]}]}, "references": {"reference_data": [{"name": "https://www.wordfence.com/blog/2021/03/cross-site-scripting-vulnerabilities-in-elementor-impact-over-7-million-sites/", "refsource": "MISC", "url": "https://www.wordfence.com/blog/2021/03/cross-site-scripting-vulnerabilities-in-elementor-impact-over-7-million-sites/"}, {"name": "https://wpscan.com/vulnerability/b72bd13d-c8e2-4347-b009-542fc0fe21bb", "refsource": "CONFIRM", "url": "https://wpscan.com/vulnerability/b72bd13d-c8e2-4347-b009-542fc0fe21bb"}]}, "source": {"discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T19:21:18.620Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.wordfence.com/blog/2021/03/cross-site-scripting-vulnerabilities-in-elementor-impact-over-7-million-sites/"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://wpscan.com/vulnerability/b72bd13d-c8e2-4347-b009-542fc0fe21bb"}]}]}, "cveMetadata": {"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "assignerShortName": "WPScan", "cveId": "CVE-2021-24202", "datePublished": "2021-04-05T18:27:46", "dateReserved": "2021-01-14T00:00:00", "dateUpdated": "2024-08-03T19:21:18.620Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:elementor:website_builder:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "493EC195-F031-4D35-9143-9399AEB9292A", "versionEndExcluding": "3.1.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "In the Elementor Website Builder WordPress plugin before 3.1.4, the heading widget (includes/widgets/heading.php) accepts a \u2018header_size\u2019 parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified \u2018save_builder\u2019 request with this parameter set to \u2018script\u2019 and combined with a \u2018title\u2019 parameter containing JavaScript, which will then be executed when the saved page is viewed or previewed."}, {"lang": "es", "value": "En el plugin de WordPress Elementor Website Builder versiones anteriores a 3.1.4, el widget heading (el archivo includes/widgets/heading.php) acepta un par\u00e1metro \"header_size\". Aunque el control de elementos enumera un conjunto fijo de posibles etiquetas html, es posible que un usuario con permisos de Colaborador o superiores env\u00ede una petici\u00f3n \"save_builder\" modificada con este par\u00e1metro establecido en \"script\" y combinado con un par\u00e1metro de \"t\u00edtle\" que contenga JavaScript , que luego ser\u00e1 ejecutado cuando la p\u00e1gina guardada es visualizada o previsualizada"}], "id": "CVE-2021-24202", "lastModified": "2024-11-21T05:52:35.087", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-04-05T19:15:16.953", "references": [{"source": "contact@wpscan.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://wpscan.com/vulnerability/b72bd13d-c8e2-4347-b009-542fc0fe21bb"}, {"source": "contact@wpscan.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.wordfence.com/blog/2021/03/cross-site-scripting-vulnerabilities-in-elementor-impact-over-7-million-sites/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://wpscan.com/vulnerability/b72bd13d-c8e2-4347-b009-542fc0fe21bb"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.wordfence.com/blog/2021/03/cross-site-scripting-vulnerabilities-in-elementor-impact-over-7-million-sites/"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "contact@wpscan.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}