Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
the login page, unsanitized. Additional Analyst Notes: - CVE Program Container: References: - https://jetpack.com/2021/03/26/vulnerabilities-found-in-patreon-wordpress-plugin/ - https://wpscan.com/vulnerability/7a5fadb1-3f1c-4779-8ff6-356fccb5269b
CVE ID: CVE-2021-24229 State: PUBLISHED Published: 2021-04-12T14:05:46 Last Updated: 2024-08-03T19:21:18.861Z Vendors: Unknown Products: Patreon WordPress Problem Types: CWE-79 Description: The Jetpack Scan team identified a Reflected Cross-Site Scripting via the patreon_save_attachment_patreon_level AJAX action of the Patreon WordPress plugin before 1.7.2. This AJAX hook is used to update the pledge level required by Patreon subscribers to access a given attachment. This action is accessible for user accounts with the ‘manage_options’ privilege (i.e.., only administrators). Unfortunately, one of the parameters used in this AJAX endpoint is not sanitized before being printed back to the user
. Unfortunately, one of the parameters used in this AJAX endpoint is not sanitized before being printed back to the user, so the risk it represents is the same as the previous XSS vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jetpack.com/2021/03/26/vulnerabilities-found-in-patreon-wordpress-plugin/ - https://wpscan.com/vulnerability/001755c4-add3-4566-a022-ab1f83546c1f
CVE ID: CVE-2021-24230 State: PUBLISHED Published: 2021-04-12T14:06:16 Last Updated: 2024-08-03T19:21:18.743Z Vendors: Unknown Products: Patreon WordPress Problem Types: CWE-352 Description: The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged in user overwrite or create arbitrary user metadata on the victim’s account once visited. If exploited, this bug can be used to overwrite the “wp_capabilities” meta, which contains the affected user account’s roles and privileges. Doing this would essentially lock them out of the site, blocking them from accessing paid content. Additional Analyst No
Doing this would essentially lock them out of the site, blocking them from accessing paid content. Additional Analyst Notes: - CVE Program Container: References: - https://jetpack.com/2021/03/26/vulnerabilities-found-in-patreon-wordpress-plugin/ - https://wpscan.com/vulnerability/2deefa2d-3043-42e5-afef-a42c37703531
CVE ID: CVE-2021-24231 State: PUBLISHED Published: 2021-04-12T14:06:31 Last Updated: 2024-08-03T19:21:18.660Z Vendors: Unknown Products: Patreon WordPress Problem Types: CWE-352 Description: The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged administrator disconnect the site from Patreon by visiting a specially crafted link. Additional Analyst Notes: - CVE Program Container: References: - https://jetpack.com/2021/03/26/vulnerabilities-found-in-patreon-wordpress-plugin/ - https://wpscan.com/vulnerability/f8ab6855-a319-47ac-82fb-58b181e77500
CVE ID: CVE-2021-24232 State: PUBLISHED Published: 2021-04-22T21:00:50 Last Updated: 2024-08-03T19:21:19.041Z Vendors: Unknown Products: Advanced Booking Calendar Problem Types: CWE-79 Description: The Advanced Booking Calendar WordPress plugin before 1.6.8 does not sanitise the license error message when output in the settings page, leading to an authenticated reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f06629b5-8b15-48eb-a7a7-78b693e06b71
CVE ID: CVE-2021-24233 State: PUBLISHED Published: 2021-04-22T21:00:50 Last Updated: 2024-08-03T19:21:18.922Z Vendors: Unknown Products: Cooked Ppro Problem Types: CWE-79 Description: The Cooked Pro WordPress plugin before 1.7.5.6 was affected by unauthenticated reflected Cross-Site Scripting issues, due to improper sanitisation of user input while being output back in pages as an arbitrary attribute. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ed620de5-1ad2-4480-b08b-719480472bc0 - https://www.getastra.com/blog/911/reflected-xss-found-in-cooked-pro-recipe-plugin-for-wordpress/ - https://www.jinsonvarghese.com/reflected-xss-vulnerability-
ected-xss-found-in-cooked-pro-recipe-plugin-for-wordpress/ - https://www.jinsonvarghese.com/reflected-xss-vulnerability-found-in-cooked-pro-plugin/
CVE ID: CVE-2021-24234 State: PUBLISHED Published: 2021-04-22T21:00:50 Last Updated: 2024-08-03T19:21:18.676Z Vendors: Unknown Products: Ivory Search – WordPress Search Plugin Problem Types: CWE-79 Description: The Search Forms page of the Ivory Search WordPress lugin before 4.6.1 did not properly sanitise the tab parameter before output it in the page, leading to a reflected Cross-Site Scripting issue when opening a malicious crafted link as a high privilege user. Knowledge of a form id is required to conduct the attack. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ecc620be-8e29-4860-9d32-86b5814a3835 - https://www.getastra.com/blog/911/p
eferences: - https://wpscan.com/vulnerability/ecc620be-8e29-4860-9d32-86b5814a3835 - https://www.getastra.com/blog/911/plugin-exploit/reflected-xss-vulnerability-in-ivory-search-wp-plugin/ - https://www.jinsonvarghese.com/reflected-xss-vulnerability-found-in-ivory-search-plugin/
CVE ID: CVE-2021-24235 State: PUBLISHED Published: 2021-04-22T21:00:50 Last Updated: 2024-08-03T19:21:18.713Z Vendors: Unknown Products: Goto Problem Types: CWE-79 Description: The Goto WordPress theme before 2.0 does not sanitise the keywords and start_date GET parameter on its Tour List page, leading to an unauthenticated reflected Cross-Site Scripting issue. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/eece90aa-582b-4c49-8b7c-14027f9df139 - https://m0ze.ru/vulnerability/%5B2021-02-10%5D-%5BWordPress%5D-%5BCWE-79%5D-Goto-WordPress-Theme-v1.9.txt
CVE ID: CVE-2021-24236 State: PUBLISHED Published: 2021-05-05T18:39:42 Last Updated: 2024-08-03T19:21:19.025Z Vendors: williewonka Products: Imagements Problem Types: CWE-434 Description: The Imagements WordPress plugin through 1.2.5 allows images to be uploaded in comments, however only checks for the Content-Type in the request to forbid dangerous files. This allows unauthenticated attackers to upload arbitrary files by using a valid image Content-Type along with a PHP filename and code, leading to RCE. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/8f24e74f-60e3-4100-9ab2-ec31b9c9cdea
CVE ID: CVE-2021-24237 State: PUBLISHED Published: 2021-04-22T21:00:50 Last Updated: 2024-08-03T19:21:18.662Z Vendors: PureThemes Products: Realteo, Findeo Problem Types: CWE-79 Description: The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not properly sanitise the keyword_search, search_radius. _bedrooms and _bathrooms GET parameters before outputting them in its properties page, leading to an unauthenticated reflected Cross-Site Scripting issue. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/087b27c4-289e-410f-af74-828a608a4e1e - https://www.docs.purethemes.net/findeo/knowledge-base/changelog-findeo/ - https://m0ze.
c4-289e-410f-af74-828a608a4e1e - https://www.docs.purethemes.net/findeo/knowledge-base/changelog-findeo/ - https://m0ze.ru/vulnerability/%5B2021-03-20%5D-%5BWordPress%5D-%5BCWE-79%5D-Findeo-WordPress-Theme-v1.3.0.txt - https://m0ze.ru/vulnerability/%5B2021-03-20%5D-%5BWordPress%5D-%5BCWE-79%5D-Realteo-WordPress-Plugin-v1.2.3.txt
CVE ID: CVE-2021-24238 State: PUBLISHED Published: 2021-04-22T21:00:51 Last Updated: 2024-08-03T19:21:18.692Z Vendors: PureThemes Products: Realteo, Findeo Problem Types: CWE-284 Description: The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not ensure that the requested property to be deleted belong to the user making the request, allowing any authenticated users to delete arbitrary properties by tampering with the property_id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.docs.purethemes.net/findeo/knowledge-base/changelog-findeo/ - https://wpscan.com/vulnerability/b8434eb2-f522-484f-9227-5f581e7f48a5 - https://m0ze.ru/vulnera
base/changelog-findeo/ - https://wpscan.com/vulnerability/b8434eb2-f522-484f-9227-5f581e7f48a5 - https://m0ze.ru/vulnerability/%5B2021-03-20%5D-%5BWordPress%5D-%5BCWE-284%5D-Findeo-WordPress-Theme-v1.3.0.txt - https://m0ze.ru/vulnerability/%5B2021-03-20%5D-%5BWordPress%5D-%5BCWE-284%5D-Realteo-WordPress-Plugin-v1.2.3.txt
CVE ID: CVE-2021-24239 State: PUBLISHED Published: 2021-04-22T21:00:51 Last Updated: 2024-08-03T19:21:18.853Z Vendors: Unknown Products: Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments Problem Types: CWE-79 Description: The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin before 3.7.0.1 does not sanitise the invitaion_code GET parameter when outputting it in the Activation Code page, leading to a reflected Cross-Site Scripting issue. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f1b67f40-642f-451e-a67a-b7487918ee34 - https://plugins
Program Container: References: - https://wpscan.com/vulnerability/f1b67f40-642f-451e-a67a-b7487918ee34 - https://plugins.trac.wordpress.org/changeset/2507536/
CVE ID: CVE-2021-24240 State: PUBLISHED Published: 2021-04-22T21:00:51 Last Updated: 2024-08-03T19:21:18.939Z Vendors: Unknown Products: Business Hours Pro Problem Types: CWE-434 Description: The Business Hours Pro WordPress plugin through 5.5.0 allows a remote attacker to upload arbitrary files using its manual update functionality, leading to an unauthenticated remote code execution vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/10528cb2-12a1-43f7-9b7d-d75d18fdf5bb - https://codecanyon.net/item/business-hours-pro-wordpress-plugin/9414879
CVE ID: CVE-2021-24241 State: PUBLISHED Published: 2021-04-22T21:00:51 Last Updated: 2024-08-03T19:21:18.775Z Vendors: Unknown Products: Advanced Custom Fields Pro Problem Types: CWE-79 Description: The Advanced Custom Fields Pro WordPress plugin before 5.9.1 did not properly escape the generated update URL when outputting it in an attribute, leading to a reflected Cross-Site Scripting issue in the update settings page. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d1e9c995-37bd-4952-b88e-945e02e3c83f - https://github.com/jdordonezn/Reflected-XSS-in-WordPress-for-ACF-PRO-before-5.9.1-plugin/issues/1 - https://www.advancedcustomfields.com/bl
jdordonezn/Reflected-XSS-in-WordPress-for-ACF-PRO-before-5.9.1-plugin/issues/1 - https://www.advancedcustomfields.com/blog/acf-5-9-1-release/
CVE ID: CVE-2021-24242 State: PUBLISHED Published: 2021-04-22T21:00:51 Last Updated: 2024-08-03T19:21:18.966Z Vendors: Themeum Products: Tutor LMS – eLearning and online course solution Problem Types: CWE-22 Description: The Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.8 is affected by a local file inclusion vulnerability through the maliciously constructed sub_page parameter of the plugin's Tools, allowing high privilege users to include any local php file Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/20f3e63a-31d8-49a0-b4ef-209749feff5c
CVE ID: CVE-2021-24243 State: PUBLISHED Published: 2021-05-05T18:39:42 Last Updated: 2024-08-03T19:21:18.708Z Vendors: bitorbit Products: WPBakery Page Builder (Visual Composer) Clipboard Problem Types: CWE-79 Description: An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.6 did not have capability checks nor sanitization, allowing low privilege users (subscriber+) to call it and set XSS payloads, which will be triggered in all backend pages. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/3bc0733a-b949-40c9-a5fb-f56814fc4af3 - https://codecanyon.net/item/visual-composer-clipboard/88
wpscan.com/vulnerability/3bc0733a-b949-40c9-a5fb-f56814fc4af3 - https://codecanyon.net/item/visual-composer-clipboard/8897711
CVE ID: CVE-2021-24244 State: PUBLISHED Published: 2021-05-05T18:39:42 Last Updated: 2024-08-03T19:21:18.915Z Vendors: bitorbit Products: WPBakery Page Builder (Visual Composer) Clipboard Problem Types: CWE-863 Description: An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.8 did not have capability checks, allowing low privilege users, such as subscribers, to update the license options (key, email). Additional Analyst Notes: - CVE Program Container: References: - https://codecanyon.net/item/visual-composer-clipboard/8897711 - https://wpscan.com/vulnerability/354b98d8-46a1-4189-b347-198701ea59b9
CVE ID: CVE-2021-24245 State: PUBLISHED Published: 2021-05-05T18:39:42 Last Updated: 2024-08-03T19:21:18.707Z Vendors: Trumani Products: Stop Spammers Problem Types: CWE-79 Description: The Stop Spammers WordPress plugin before 2021.9 did not escape user input when blocking requests (such as matching a spam word), outputting it in an attribute after sanitising it to remove HTML tags, which is not sufficient and lead to a reflected Cross-Site Scripting issue. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/5e7accd6-08dc-4c6e-9d19-73e2d7e97735 - http://packetstormsecurity.com/files/162623/WordPress-Stop-Spammers-2021.8-Cross-Site-Scripting.html
CVE ID: CVE-2021-24246 State: PUBLISHED Published: 2021-05-05T18:39:43 Last Updated: 2024-08-03T19:21:18.683Z Vendors: PureThemes Products: Workscout Core, WorkScout Problem Types: CWE-79 Description: The Workscout Core WordPress plugin before 1.3.4, used by the WorkScout Theme did not sanitise the chat messages sent via the workscout_send_message_chat AJAX action, leading to Stored Cross-Site Scripting and Cross-Frame Scripting issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/2365a9d0-f6f4-4602-9804-5af23d0cb11d - https://m0ze.ru/vulnerability/%5B2021-02-10%5D-%5BWordPress%5D-%5BCWE-79%5D-WorkScout-WordPress-Theme-v2.0.33.txt
CVE ID: CVE-2021-24247 State: PUBLISHED Published: 2021-05-05T18:39:43 Last Updated: 2024-08-03T19:21:18.930Z Vendors: MooveAgency Products: Contact Form Check Tester Problem Types: CWE-79 Description: The Contact Form Check Tester WordPress plugin through 1.0.2 settings are visible to all registered users in the dashboard and are lacking any sanitisation. As a result, any registered user, such as subscriber, can leave an XSS payload in the plugin settings, which will be triggered by any user visiting them, and could allow for privilege escalation. The vendor decided to close the plugin. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e2990a7
se the plugin. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e2990a7a-d4f0-424e-b01d-ecf67cf9c9f3
CVE ID: CVE-2021-24248 State: PUBLISHED Published: 2021-05-05T18:39:43 Last Updated: 2024-08-03T19:21:18.654Z Vendors: Business Directory Team Products: Business Directory Plugin – Easy Listing Directories for WordPress Problem Types: CWE-434 Description: The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.1 did not properly check for imported files, forbidding certain extension via a blacklist approach, allowing administrator to import an archive with a .php4 inside for example, leading to RCE Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ca886a34-cd2b-4032-9de1-8089b5cf3001
CVE ID: CVE-2021-24249 State: PUBLISHED Published: 2021-05-05T18:39:43 Last Updated: 2024-08-03T19:21:18.826Z Vendors: Business Directory Team Products: Business Directory Plugin – Easy Listing Directories for WordPress Problem Types: CWE-352 Description: The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from a Cross-Site Request Forgery issue, allowing an attacker to make a logged in administrator export files, which could then be downloaded by the attacker to get access to PII, such as email, home addresses etc Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/fc4cf749-34ef-43b8-a52
Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/fc4cf749-34ef-43b8-a529-5065d698ab81
CVE ID: CVE-2021-24250 State: PUBLISHED Published: 2021-05-05T18:39:43 Last Updated: 2024-08-03T19:21:18.860Z Vendors: Business Directory Team Products: Business Directory Plugin – Easy Listing Directories for WordPress Problem Types: CWE-79 Description: The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from lack of sanitisation in the label of the Form Fields, leading to Authenticated Stored Cross-Site Scripting issues across various pages of the plugin. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e23bf712-d891-4df7-99cc-9ef64f19f685
CVE ID: CVE-2021-24251 State: PUBLISHED Published: 2021-05-05T18:39:43 Last Updated: 2024-08-03T19:28:22.248Z Vendors: Business Directory Team Products: Business Directory Plugin – Easy Listing Directories for WordPress Problem Types: CWE-352 Description: The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from a Cross-Site Request Forgery issue, allowing an attacker to make a logged in administrator update arbitrary payment history, such as change their status (from pending to completed to example) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c9911236-4af3-4557-9bc0-217face534e1
CVE ID: CVE-2021-24252 State: PUBLISHED Published: 2021-05-05T18:39:43 Last Updated: 2024-08-03T19:28:22.564Z Vendors: Unknown Products: Event Banner Problem Types: CWE-434 Description: The Event Banner WordPress plugin through 1.3 does not verify the uploaded image file, allowing admin accounts to upload arbitrary files, such as .exe, .php, or others executable, leading to RCE. Due to the lack of CSRF check, the issue can also be used via such vector to achieve the same result, or via a LFI as authorisation checks are missing (but would require WP to be loaded) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/91e81c6d-f24d-4f87-bc13-746715af8
Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/91e81c6d-f24d-4f87-bc13-746715af8f7c - https://github.com/jinhuang1102/CVE-ID-Reports/blob/master/Event%20Banner.md
CVE ID: CVE-2021-24253 State: PUBLISHED Published: 2021-05-05T18:39:43 Last Updated: 2024-08-03T19:28:22.247Z Vendors: Unknown Products: Classyfrieds Problem Types: CWE-434 Description: The Classyfrieds WordPress plugin through 3.8 does not properly check the uploaded file when an authenticated user adds a listing, only checking the content-type in the request. This allows any authenticated user to upload arbitrary PHP files via the Add Listing feature of the plugin, leading to RCE. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ee42c233-0ff6-4b27-a5ec-ad3246bef079 - https://github.com/jinhuang1102/CVE-ID-Reports/blob/master/classyfrieds.md
CVE ID: CVE-2021-24254 State: PUBLISHED Published: 2021-05-05T18:39:44 Last Updated: 2024-08-03T19:28:22.246Z Vendors: Unknown Products: College publisher Import Problem Types: CWE-434 Description: The College publisher Import WordPress plugin through 0.1 does not check for the uploaded CSV file to import, allowing high privilege users to upload arbitrary files, such as PHP, leading to RCE. Due to the lack of CSRF check, the issue could also be exploited via a CSRF attack. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/bb3e56dd-ae2e-45c2-a6c9-a59ae5fc1dc4 - https://github.com/jinhuang1102/CVE-ID-Reports/blob/master/College%20Puglisher%20Impo
56dd-ae2e-45c2-a6c9-a59ae5fc1dc4 - https://github.com/jinhuang1102/CVE-ID-Reports/blob/master/College%20Puglisher%20Import.md
CVE ID: CVE-2021-24255 State: PUBLISHED Published: 2021-05-05T18:28:45 Last Updated: 2024-08-03T19:28:22.650Z Vendors: Unknown Products: Essential Addons for Elementor Problem Types: CWE-79 Description: The Essential Addons for Elementor Lite WordPress Plugin before 4.5.4 has two widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, both via a similar method. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/7fb708da-e8c4-4455-b4f9-c4ad72f877da - https://www.wordfence.com/blog/2021/04/recent-patches-rock-the-elementor-ecosystem/
CVE ID: CVE-2021-24256 State: PUBLISHED Published: 2021-05-05T18:28:45 Last Updated: 2024-08-03T19:28:22.736Z Vendors: Unknown Products: Elementor – Header, Footer & Blocks Template Problem Types: CWE-79 Description: The “Elementor – Header, Footer & Blocks Template” WordPress Plugin before 1.5.8 has two widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2021/04/recent-patches-rock-the-elementor-ecosystem/ - https://wpscan.com/vulnerability/a9412fed-aed3-4931-a504-1a86f876892e
CVE ID: CVE-2021-24257 State: PUBLISHED Published: 2021-05-05T18:28:46 Last Updated: 2024-08-03T19:28:22.250Z Vendors: Unknown Products: Premium Addons for Elementor Problem Types: CWE-79 Description: The “Premium Addons for Elementor” WordPress Plugin before 4.2.8 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2021/04/recent-patches-rock-the-elementor-ecosystem/ - https://wpscan.com/vulnerability/4ad8314e-1cbe-4642-b4ee-aac2060f9a25
CVE ID: CVE-2021-24258 State: PUBLISHED Published: 2021-05-05T18:28:46 Last Updated: 2024-08-03T19:28:22.245Z Vendors: Wpmet Products: Elements Kit Lite, Elements Kit Pro Problem Types: CWE-79 Description: The Elements Kit Lite and Elements Kit Pro WordPress Plugins before 2.2.0 have a number of widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2021/04/recent-patches-rock-the-elementor-ecosystem/ - https://wpscan.com/vulnerability/47b47b86-899b-4de3-8a3c-2d5d1774298f
CVE ID: CVE-2021-24259 State: PUBLISHED Published: 2021-05-05T18:28:46 Last Updated: 2024-08-03T19:28:22.703Z Vendors: Unknown Products: Elementor Addon Elements Problem Types: CWE-79 Description: The “Elementor Addon Elements” WordPress Plugin before 1.11.2 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2021/04/recent-patches-rock-the-elementor-ecosystem/ - https://wpscan.com/vulnerability/0719063f-7743-4a34-94b9-f67fd98e5990