Stored Cross-Site Scripting in Essential Addons for Elementor Pricing Table Title Tag

Essential Addons for Elementor before 6.6.10 does not validate the HTML tag name configured for the Pricing Table widget title before rendering it. Because the value is used as a raw tag name, esc_html() does not constrain it, so an authenticated attacker with Contributor-level access or above can inject JavaScript that executes when the post is... Weiterlesen