Romain Deperne

**Name of the Vulnerable Software and Affected Versions** Easy Accordion versions prior to 3.1.9 **Description** Stored Cross-Site Scripting occurs when authenticated attackers with contributor-level access or higher inject arbitrary web scripts into pages. The issue stems from insufficient input sanitization and output escaping within the `accordion header renderer()` function. Specifically, the function uses `esc attr()` instead of `tag escape()` when processing the `accordionTitleTag` block attribute in an HTML tag-name context, allowing the execution of scripts whenever a user visits the affected page. **Recommendations** Update Easy Accordion to version 3.1.9 or later. As a temporary mitigation, restrict access to the `accordionTitleTag` attribute for users with contributor-level permissions.

**Name of the Vulnerable Software and Affected Versions** News Kit Addons For Elementor versions prior to 1.4.7 **Description** Stored Cross-Site Scripting occurs in the Site Logo Title and Single Author Box Widgets due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. These scripts execute when a user visits the affected page. Exploitation involves intercepting and modifying the `elementor ajax` AJAX save request to bypass client-side SELECT control restrictions and submit arbitrary tag-name values. **Recommendations** Update News Kit Addons For Elementor to version 1.4.7 or later.

**Name of the Vulnerable Software and Affected Versions** myCred versions prior to 3.2 **Description** The myCred plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts through the `wrap` shortcode attribute. These scripts execute whenever a user visits the affected page. **Recommendations** Update to a version later than 3.1.

**Name of the Vulnerable Software and Affected Versions** aThemes Addons for Elementor versions prior to 1.1.9 **Description** The plugin is subject to Stored Cross-Site Scripting, a flaw where malicious scripts are permanently stored on the target server. This occurs due to insufficient input sanitization and output escaping within the `title tag` widget setting. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. These scripts execute when a user visits the affected page. The issue specifically impacts the Posts Timeline widget and the Posts Carousel widget (including its default, Banner, and Modern skins), as these components lack the whitelist validation used in the Posts List widget. **Recommendations** Update to a version later than 1.1.8.

**Name of the Vulnerable Software and Affected Versions** Prime Elementor Addons versions prior to 1.3.4 **Description** Insufficient input sanitization and output escaping in the Widget HTML Tag Settings allow authenticated attackers with contributor-level access or higher to perform Stored Cross-Site Scripting. This occurs because payloads without HTML angle brackets, such as `img src=x onerror=alert(document.domain)`, bypass the `wp kses post()` filter, enabling the injection of arbitrary web scripts that execute when a user visits the affected page. **Recommendations** Update to a version newer than 1.3.3.

**Name of the Vulnerable Software and Affected Versions** Royal Elementor Addons and Templates versions prior to 1.7.1059 **Description** The Royal Elementor Addons and Templates plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts through the `title tag` parameter. These scripts execute whenever a user visits the affected page. **Recommendations** Update the plugin to a version later than 1.7.1058. As a temporary workaround, restrict access for users with Contributor-level permissions to prevent the use of the `title tag` parameter.