Ultimate Addons For Elementor Lite
Monthly
Stored cross-site scripting (CWE-79) in the Ultimate Addons for Elementor - Lite plugin (slug header-footer-elementor) affects every release through 2.9.5. An authenticated WordPress user who holds enough privilege to save content into the affected plugin fields can persist a script payload that later executes in the browser of another user who loads the page or screen rendering it, giving a scope-changed (S:C) impact rated 6.5 under CVSS 3.1. The flaw requires an account (PR:L) and victim interaction (UI:R); it is not listed in CISA KEV and no public exploit was identified at time of analysis, so it should be handled as a routine, prioritized patch within the current monthly cycle rather than an emergency.
Stored cross-site scripting (CWE-79) in the Ultimate Addons for Elementor - Lite plugin (slug header-footer-elementor) affects every release through 2.9.5. An authenticated WordPress user who holds enough privilege to save content into the affected plugin fields can persist a script payload that later executes in the browser of another user who loads the page or screen rendering it, giving a scope-changed (S:C) impact rated 6.5 under CVSS 3.1. The flaw requires an account (PR:L) and victim interaction (UI:R); it is not listed in CISA KEV and no public exploit was identified at time of analysis, so it should be handled as a routine, prioritized patch within the current monthly cycle rather than an emergency.