Gum Addon For Elementor
Monthly
Stored cross-site scripting in the Gum Addon for Elementor WordPress plugin (all versions up to and including 1.3.15) allows authenticated users with contributor-level access or higher to inject arbitrary JavaScript via the 'pop_tag' parameter of the popover button widget, which then executes in the browser of any user - including administrators - who views the affected page. The prerequisite is a valid low-privilege account plus an active, widget-enabled installation, so risk is concentrated on multi-author sites or blogs that permit open contributor registration; no public exploit code has been identified at time of analysis, and CVSS 3.1 scores the issue 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting limited confidentiality and integrity impact but a scope change because the payload crosses from the authoring context into other users' sessions.
Stored cross-site scripting in the Gum Addon for Elementor WordPress plugin (all versions up to and including 1.3.15) allows authenticated users with contributor-level access or higher to inject arbitrary JavaScript via the 'pop_tag' parameter of the popover button widget, which then executes in the browser of any user - including administrators - who views the affected page. The prerequisite is a valid low-privilege account plus an active, widget-enabled installation, so risk is concentrated on multi-author sites or blogs that permit open contributor registration; no public exploit code has been identified at time of analysis, and CVSS 3.1 scores the issue 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting limited confidentiality and integrity impact but a scope change because the payload crosses from the authoring context into other users' sessions.