Lucene search
HistoryAug 14, 2023 - 8:15 p.m.
CVE-2022-4953
cve-2022-4953
elementor
wordpress
dom
vulnerability
user-controlled urls
malicious iframes
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
0.002 Low
EPSS
Percentile
61.5%
The Elementor Website Builder WordPress plugin before 3.5.5 does not filter out user-controlled URLs from being loaded into the DOM. This could be used to inject rogue iframes that point to malicious URLs.
Affected configurations
Node
elementorwebsite_builderRange<3.5.5wordpress
Related
openvas
openvas
wpvulndb
wpvulndb
Elementor < 3.5.5 - Iframe Injection
2023-07-19 00:00:00
prion
prion
Design/Logic Flaw
2023-08-14 20:15:00
wpexploit
wpexploit
Elementor < 3.5.5 - Iframe Injection
2023-07-19 00:00:00
packetstorm
packetstorm
WordPress Elementor Iframe Injection
2023-09-08 00:00:00
osv
osv
CVE-2022-4953
2023-08-14 20:15:10
zdt
zdt
Wordpress Elementor 3.5.5 Plugin - Iframe Injection Vulnerability
2023-09-11 00:00:00
cve
cve
CVE-2022-4953
2023-08-14 20:15:10
cvelist
cvelist
CVE-2022-4953 Elementor < 3.5.5 - Iframe Injection
2023-08-14 19:10:18
exploitdb
exploitdb
Wordpress Plugin Elementor 3.5.5 - Iframe Injection
2023-09-08 00:00:00
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
0.002 Low
EPSS
Percentile
61.5%
Related for NVD:CVE-2022-4953