Threats tagged 'ghsa-5fj7-xcmr-5r75'

A stored Cross-Site Scripting (XSS) vulnerability exists in the ElementsKit Elementor Addons WordPress plugin before version 3.10.01. The plugin fails to sanitize or escape certain megamenu menu-item settings before storing and rendering them on the front end. This allows users with administrative capabilities, including non-super subsite administrators on multisite networks without unfiltered_html capability, to inject malicious JavaScript that can execute in the sessions of network Super Admins and site visitors.