Stax Addons For Elementor Vulnerabilities

The Elementor Addons, Widgets and Enhancements – Stax plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inje...

CVSS:

6.4

Affected:

up to 1.5.0

Fixed in:

1.5.1

Disclosed:

Jul 6, 2024

CVE-2024-37541 on NVD →

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in StaxWP Elementor Addons, Widgets and Enhancements – Stax allows Stored XSS.This issue affects Elementor Addons, Widgets and Enhancements – Stax: from n/a through 1.4.4.1.

Affected:

up to 1.4.4.1

Fix:

No patched version reported

Disclosed:

Jul 6, 2024

CVE-2024-37541 on NVD →

[en] The Elementor Addons, Widgets and Enhancements – Stax plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Heading' widgets in all versions up to, and including, 1.4.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

Affected:

up to 1.4.4.1

Fix:

No patched version reported

Disclosed:

Apr 9, 2024

CVE-2024-3064 on NVD →

The Elementor Addons, Widgets and Enhancements – Stax plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Heading' widgets in all versions up to, and including, 1.4.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for auth...

CVSS:

6.4

Affected:

up to 1.4.4.1

Fix:

No patched version reported

Disclosed:

Apr 4, 2024

CVE-2024-3064 on NVD →

[en] The Elementor Addons, Widgets and Enhancements – Stax plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the toggle_widget function in versions up to, and including, 1.4.3. This makes it possible for authenticated attackers, with subscriber-level permission...

Affected:

up to 1.4.4

Fixed in:

1.4.4

Disclosed:

Jun 9, 2023

CVE-2023-2189 on NVD →

[en] The Elementor Addons, Widgets and Enhancements – Stax plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.3. This is due to missing or incorrect nonce validation on the toggle_widget function. This makes it possible for unauthenticated attackers to enable or disab...

Affected:

up to 1.4.3

Fixed in:

1.4.3

Disclosed:

Jun 9, 2023

CVE-2023-1807 on NVD →

The Elementor Addons, Widgets and Enhancements – Stax plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the toggle_widget function in versions up to, and including, 1.4.3. This makes it possible for authenticated attackers, with subscriber-level permissions and...

CVSS:

4.3

Affected:

up to 1.4.3

Fixed in:

1.4.4

Disclosed:

Jun 8, 2023

CVE-2023-2189 on NVD →

The Elementor Addons, Widgets and Enhancements – Stax plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.3. This is due to missing or incorrect nonce validation on the toggle_widget function. This makes it possible for unauthenticated attackers to enable or disable El...

CVSS:

4.3

Affected:

up to 1.4.3

Fixed in:

1.4.4

Disclosed:

Jun 8, 2023

CVE-2023-1807 on NVD →

The Appsero analytics tool used in several plugins is vulnerable to authorization bypass due to a missing capability check on the uninstall_reason_submission function used for feedback submission in versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with subscriber-level permissio...

CVSS:

4.3

Affected:

up to 1.4.3

Fixed in:

1.4.4

Disclosed:

Dec 16, 2022

The Appsero analytics tool used in several plugins is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the uninstall_reason_submission function used for feedback submission in versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to invoke this function inten...

CVSS:

4.3

Affected:

up to 1.4.3

Fixed in:

1.4.4

Disclosed:

Dec 14, 2022

CVE-2022-47150 on NVD →

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Affected:

up to 1.4.4.1

Fixed in:

1.4.4.1

CVE-2022-47150 on NVD →