Threats tagged 'ghsa-2399-8798-9wxx'

The Elementor Website Builder WordPress plugin versions before 4.3.6 contain a vulnerability where an element identifier is not validated or escaped before being rendered into a client-side attribute evaluated as JavaScript. This flaw allows users with the Contributor role to inject scripts that execute in the browsers of anyone viewing the affected content, including administrators reviewing submissions.