Stored Cross-Site Scripting in Elementor Star Rating Widget

The Star Rating widget did not coerce its configured rating value to a number before embedding it in the rendered markup, so a non-numeric value was passed through verbatim. An authenticated user who can edit Elementor content (Contributor and above) could store arbitrary HTML or JavaScript in the rating setting, which then executed in the browser... Weiterlesen