CVE-2021-24292

The Happy Addons for Elementor WordPress plugin before 2.24.0, Happy Addons Pro for Elementor WordPress plugin before 1.17.0 have a number of widgets that are vulnerable to stored Cross-Site Scripting(XSS) by lower-privileged users such as contributors, all via a similar method: The “Card” widget accepts a “title_tag” parameter. Although the element control lists a fixed set of possible html tags, it is possible to send a ‘save_builder’ request with the “heading_tag” set to “script”, and the actual “title” parameter set to JavaScript to be executed within the script tags added by the “heading_tag” parameter.

• CWE-79

• https://wpscan.com/vulnerability/0f20e098-8106-451f-9448-d35a79f03077Exploit, Third Party Advisory
• https://www.wordfence.com/blog/2021/04/recent-patches-rock-the-elementor-ecosystem/Third Party Advisory
• https://wpscan.com/vulnerability/0f20e098-8106-451f-9448-d35a79f03077Exploit, Third Party Advisory
• https://www.wordfence.com/blog/2021/04/recent-patches-rock-the-elementor-ecosystem/Third Party Advisory

Published

May 17, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-24287The settings page of the Select All Categories and Taxonomie…6.1
• CVE-2021-24288When subscribing using AcyMailing, the 'redirect' parameter …6.1
• CVE-2021-24289There is functionality in the Store Locator Plus for WordPre…8.8
• CVE-2021-2429Vulnerability in the MySQL Server product of Oracle MySQL (c…5.9
• CVE-2021-24290There are several endpoints in the Store Locator Plus for Wo…6.1
• CVE-2021-24291The Photo Gallery by 10Web – Mobile-Friendly Image Gallery W…6.1
• CVE-2021-24293In the eCommerce module of the NextGEN Gallery Pro WordPress…6.1
• CVE-2021-24294The dsgvoaio_write_log AJAX action of the DSGVO All in one f…6.1
• CVE-2021-24295It was possible to exploit an Unauthenticated Time-Based Bli…7.5
• CVE-2021-24296The WP Customer Reviews WordPress plugin before 3.5.6 did no…4.8
• CVE-2021-24297The Goto WordPress theme before 2.1 did not properly sanitiz…6.1
• CVE-2021-24298The method and share GET parameters of the Giveaway pages we…6.1