CVE-2024-4471

🗓️ 23 May 2024 12:43:37Reported by WordfenceType

Vulnerability in 140+ Widgets WordPress plugin version 1.4.3.1 allows PHP Object Injection via 'export_content' function, enabling authenticated attackers to inject PHP Objects leading to potential code execution, data retrieval, and file deletion

Reporter	Title	Published	Views	Family All 11
CNNVD	WordPress plugin 140+ Widgets Best Addons For Elementor–FREE 安全漏洞	23 May 202400:00	–	cnnvd
Cvelist	CVE-2024-4471 140+ Widgets \| Best Addons For Elementor – FREE <= 1.4.3.1 - Authenticated (Contributor+) PHP Object Injection	23 May 202412:43	–	cvelist
EUVD	EUVD-2024-44086	3 Oct 202520:07	–	euvd
NVD	CVE-2024-4471	23 May 202413:15	–	nvd
Patchstack	WordPress 140+ Widgets \| Best Addons For Elementor – FREE plugin <= 1.4.3.1 - Authenticated (Contributor+) PHP Object Injection vulnerability	24 May 202405:34	–	patchstack
Patchstack	WordPress Xpro Elementor Addons Plugin <= 1.4.3.1 is vulnerable to PHP Object Injection	24 May 202400:00	–	patchstack
Positive Technologies	PT-2024-31215 · WordPress · The 140+ Widgets	23 May 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-4471	4 Feb 202523:59	–	redhatcve
Vulnrichment	CVE-2024-4471 140+ Widgets \| Best Addons For Elementor – FREE <= 1.4.3.1 - Authenticated (Contributor+) PHP Object Injection	23 May 202412:43	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (May 20, 2024 to May 26, 2024)	30 May 202415:23	–	wordfence

Vulners

Node

xpro xpro_addons_140+_widgets_for_elementorRange≤1.4.3.1wordpress

[
  {
    "vendor": "xpro",
    "product": "Xpro Addons — 140+ Widgets for Elementor",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.4.3.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset/3090127/
plugins	www.plugins.trac.wordpress.org/browser/xpro-elementor-addons/trunk/libs/demo-export/classes/class-demo-export-admin.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/5c517278-9d2a-4ef6-bf0e-a62f6b00dd20

15 Apr 2026 00:35Current

8High risk

Vulners AI Score8

CVSS 3.18

EPSS0.00491

SSVC

CWE-502