| Package | Affected versions | Patched versions |
|---|---|---|
| website builder | ≥ 3.2.0, < 3.4.8> 1.5.0, < 3.1.4 | 3.4.83.1.4 |
The Elementor Website Builder WordPress plugin before 3.4.8 does not sanitise or escape user input appended to the DOM via a malicious hash, resulting in a DOM Cross-Site Scripting issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free