The “Ultimate Addons for Elementor” WordPress Plugin before 1.30.0 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
oryginał ENCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NBrainstormforce Ultimate Addons For Elementor
APPBrainstormforce< 1.30.0
🟢
PATCH DOSTĘPNY
Aktualizacja od producenta gotowa. Wdrożenie w ramach standardowego cyklu.
Tagi
XSS
CWE
Powiązane podatności
CVE-2024-37455HIGH8.8ten sam produkt
Improper Privilege Management vulnerability in Brainstorm Force Ultimate Addons for Elementor allows Privilege...
CVE-2020-13125MEDIUM6.5ten sam produkt
An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploite...
CVE-2023-49830CRITICAL9.9PL ✓ten sam vendor
RCE w Astra Pro – code injection dostępny dla zalogowanych użytkowników
CVE-2021-24507CRITICAL9.8ten sam vendor
The Astra Pro Addon WordPress plugin before 3.5.2 did not properly sanitise or escape some of the POST paramet...
CVE-2025-6691HIGH8.1ten sam vendor
The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file ...