Threats tagged 'ghsa-4w32-4c6r-m74m'

The Elementor Website Builder plugin for WordPress versions up to and including 4.0.4 is vulnerable to stored cross-site scripting (XSS) via the _elementor_data meta field. This occurs due to insufficient input sanitization of form-encoded REST API requests, allowing authenticated users with contributor-level access or higher to inject malicious scripts. The vulnerability arises because sanitization is skipped when processing form-encoded PATCH requests, leading to unsanitized data being stored and later rendered without escaping.