CyberRota Analysis
AI-GeneratedThe Plus Addons for Elementor plugin for WordPress is vulnerable to stored cross-site scripting (XSS) attacks through the `custom_attributes` setting in the Button widget, affecting versions up to 6.4.11. This vulnerability allows authenticated users with Contributor or higher roles to inject malicious scripts, potentially compromising site integrity and user data. WordPress site administrators using this plugin should prioritize updating to version 6.4.12 to mitigate the risk.
Original NVD Description
The Plus Addons for Elementor plugin for WordPress was vulnerable to Authenticated (Contributor+) Stored Cross-Site Scripting via the Button widget's `custom_attributes` setting in versions up to and including 6.4.11. The `render` function in `modules/widgets/tp_button.php` passed the raw `custom_attributes` string through `tp_senitize_js_input()`. This filter is bypassable. The issue is patched in version 6.4.12.