Elementor did not always sanitize certain user-supplied text/attributes before saving and rendering them. Because of that, a user who can create or edit title in heading widget, which would run later when the page is opened by other users.
This vulnerability affects the following application versions:
- Elementor Website Builder 3.28.0
- Elementor Website Builder 3.28.0-beta1
- Elementor Website Builder 3.28.0-beta2
- Elementor Website Builder 3.28.0-beta3
- Elementor Website Builder 3.28.0-dev1
- Elementor Website Builder 3.28.0-dev2
- Elementor Website Builder 3.28.0-dev3
- Elementor Website Builder 3.28.1
- Elementor Website Builder 3.28.2
- Elementor Website Builder 3.28.3
- Elementor Website Builder 3.28.4
- Elementor Website Builder 3.29.0
- Elementor Website Builder 3.29.0-beta1
- Elementor Website Builder 3.29.0-beta2
- Elementor Website Builder 3.29.0-beta3
- Elementor Website Builder 3.29.0-beta4
- Elementor Website Builder 3.29.0-dev1
- Elementor Website Builder 3.29.0-dev2
- Elementor Website Builder 3.29.0-dev3
- Elementor Website Builder 3.29.0-dev4