title: Essential Addons for Elementor Lite <= 5.0.8 Reflected Cross-Site Scripting
description: The Essential Addons for Elementor Lite WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the settings parameter found in the ~/includes/Traits/Helper.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever a user clicks on a specially crafted link by an attacker. This affects versions up to and including 5.0.8.
problem types: CWE-79 Cross-site Scripting (XSS)
affected:
{
product: Essential Addons for Elementor Lite
vendor: Essential Addons for Elementor Lite
versions:
lessThanOrEqual: 5.0.8, status: affected, version: 5.0.8, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
]
solutions: Update to version 5.0.9 or newer.