CVE-2024-10538

Name of the Vulnerable Software and Affected Versions The Happy Addons for Elementor plugin for WordPress versions up to, and including, 3.12.5

Description The issue is related to Stored Cross-Site Scripting via the before label parameter in the Image Comparison widget due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The estimated number of potentially affected sites is 400,000 or more.

Recommendations For versions up to, and including, 3.12.5, update the plugin to a version later than 3.12.5 to mitigate the risk. As a temporary workaround, consider restricting access to the Image Comparison widget until a patch is available. Avoid using the before label parameter in the affected widget until the issue is resolved.