Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-13548: Power Ups for Elementor: Stored Cross-Site Scripting in Magic-Button Shortcode

CVE-2024-13548 · published 1 year ago

Summary

The Power Ups for Elementor plugin for WordPress has a security flaw that allows attackers to inject malicious code into pages. This can happen when a contributor-level user or higher accesses a page with the affected shortcode. To protect your site, update the plugin to the latest version.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
wppug	power_ups_for_elementor	<= 1.2.2 `cpe:2.3:a:wppug:power_ups_for_elementor::::::wordpress::*`

Original advisory text

The Power Ups for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'magic-button' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

References

https://plugins.trac.wordpress.org/browser/power-ups-for-elementor/trunk/modules... Product
https://wordpress.org/plugins/power-ups-for-elementor/ Product
https://www.wordfence.com/threat-intel/vulnerabilities/id/3b7ab552-1ec5-4479-84b... Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

5.4 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published25 Jan 2025

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2024-13548 · NVD

Track software like this

Free during beta