{"id":"CVE-2024-7064","aliases":["EUVD-2024-48061","GHSA-v5hg-j2mx-ff74"],"status":"published","title":"ElementsKit Pro \u003c= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","description":"The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","severity":{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00263,"percentile":0.18236,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2024-08-15T05:30:55Z","modified":"2026-06-17T08:19:17Z","products":[{"vendor":"wpmet","product":"elementskit"},{"vendor":"wpmet","product":"elementskit pro"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/181e6f3a-dbcf-44a6-b725-6325d9e56453?source=cve","tags":["Third Party Advisory"]},{"url":"https://wpmet.com/plugin/elementskit/","tags":["Product"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-7064"},{"url":"https://wpmet.com/plugin/elementskit"},{"url":"https://github.com/advisories/GHSA-v5hg-j2mx-ff74"}],"sources":{"cve":[{"id":"CVE-2024-7064","title":"ElementsKit Pro \u003c= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","description":"The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2024-08-15T05:30:55.369Z","modified":"2026-04-08T16:37:35.05Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:20.673123Z"}],"euvd":[{"id":"EUVD-2024-48061","description":"The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2024-08-15T05:30:55Z","modified":"2026-04-08T16:37:35Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:25:07.886903Z"}],"ghsa":[{"id":"GHSA-v5hg-j2mx-ff74","title":"The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several...","description":"The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2024-08-15T06:32:22Z","modified":"2024-08-15T06:32:22Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:57:58.630404Z"}],"nvd":[{"id":"CVE-2024-7064","description":"The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2024-08-15T06:15:12.16Z","modified":"2026-06-17T08:19:17.637Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:19.135392Z"}]}}