Stored Cross-Site Scripting in Elementor Heading and Divider Widgets
Before version 3.1.4, the Elementor Heading and Divider widgets accepted any HTML tag name in their tag setting, not just the ones offered in the editor. A user with Contributor access or above could save a widget that renders as a script tag, which runs JavaScript for visitors and for administrators who open the page in the editor. Also covers CVE-2021-24203 (Divider widget).
This vulnerability affects the following application versions:
- Elementor Website Builder 2.8.0
- Elementor Website Builder 2.8.0-beta1
- Elementor Website Builder 2.8.0-beta2
- Elementor Website Builder 2.8.0-beta3
- Elementor Website Builder 2.8.0-beta4
- Elementor Website Builder 2.8.1
- Elementor Website Builder 2.8.2
- Elementor Website Builder 2.8.3
- Elementor Website Builder 2.8.4
- Elementor Website Builder 2.8.5
- Elementor Website Builder 2.9.0
- Elementor Website Builder 2.9.0-beta1
- Elementor Website Builder 2.9.0-beta2
- Elementor Website Builder 2.9.0-beta3
- Elementor Website Builder 2.9.0-beta4
- Elementor Website Builder 2.9.0-beta5
- Elementor Website Builder 2.9.1
- Elementor Website Builder 2.9.2
- Elementor Website Builder 2.9.3
- Elementor Website Builder 2.9.4
- Elementor Website Builder 2.9.5
- Elementor Website Builder 2.9.6
- Elementor Website Builder 2.9.7
- Elementor Website Builder 2.9.8
- Elementor Website Builder 2.9.9
- Elementor Website Builder 2.9.10
- Elementor Website Builder 2.9.11
- Elementor Website Builder 2.9.12
- Elementor Website Builder 2.9.13
- Elementor Website Builder 2.9.14
- Elementor Website Builder 3.0.0
- Elementor Website Builder 3.0.0-beta1
- Elementor Website Builder 3.0.0-beta2
- Elementor Website Builder 3.0.0-beta3
- Elementor Website Builder 3.0.0-beta4
- Elementor Website Builder 3.0.0-beta5
- Elementor Website Builder 3.0.0-beta6
- Elementor Website Builder 3.0.1
- Elementor Website Builder 3.0.2
- Elementor Website Builder 3.0.3
- Elementor Website Builder 3.0.4
- Elementor Website Builder 3.0.5
- Elementor Website Builder 3.0.6
- Elementor Website Builder 3.0.7
- Elementor Website Builder 3.0.8
- Elementor Website Builder 3.0.8.1
- Elementor Website Builder 3.0.9
- Elementor Website Builder 3.0.10
- Elementor Website Builder 3.0.11
- Elementor Website Builder 3.0.12
- Elementor Website Builder 3.0.13
- Elementor Website Builder 3.0.14
- Elementor Website Builder 3.0.15
- Elementor Website Builder 3.0.16
- Elementor Website Builder 3.1.0
- Elementor Website Builder 3.1.0-beta1
- Elementor Website Builder 3.1.0-beta2
- Elementor Website Builder 3.1.0-beta3
- Elementor Website Builder 3.1.0-beta4
- Elementor Website Builder 3.1.0-dev1
- Elementor Website Builder 3.1.0-dev2
- Elementor Website Builder 3.1.0-dev3
- Elementor Website Builder 3.1.0-dev4
- Elementor Website Builder 3.1.1
- Elementor Website Builder 3.1.2
- Elementor Website Builder 3.1.3
- Elementor Website Builder 3.2.0-dev1
- Elementor Website Builder 3.2.0-dev2
- Elementor Website Builder 3.2.0-dev3
- Elementor Website Builder 3.2.0-dev4
- Elementor Website Builder 3.2.0-dev5
- Elementor Website Builder 3.2.0-dev6