PT-2021-15750

Name of the Vulnerable Software and Affected Versions: Elementor Website Builder WordPress plugin versions prior to 3.1.4 Description: The issue allows a user with Contributor or above permissions to inject JavaScript into the title size parameter of the icon box widget. This JavaScript is not...

PT-2021-15747

Name of the Vulnerable Software and Affected Versions: Elementor Website Builder WordPress plugin versions prior to 3.1.4 Description: The issue allows a user with Contributor or above permissions to execute JavaScript code when a saved page is viewed or previewed. This is achieved by modifying t...

PT-2021-15749

Name of the Vulnerable Software and Affected Versions: Elementor Website Builder WordPress plugin versions prior to 3.1.4 Description: The issue concerns the accordion widget in the Elementor Website Builder WordPress plugin. A user with Contributor or above permissions can send a modified 'save...

WordPress 跨站脚本漏洞

WordPress is a blogging platform developed by the WordPress Wordpress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. elementor is a drag-and-drop website builder plugin used in it. A security vulnerability exists in the WordPress plugin...

WordPress插件Elementor Website Builder 跨站脚本漏洞

WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Related Posts is a plugin for adding related content.iframe is an inline frame for embedding another document into the current HTML document.Elementor Page Builder...

CVE-2021-24204: Improper Neutralization of Input During Web Page Generation

In the Elementor Website Builder WordPress plugin before 3.1.4, the accordion widget includes/widgets/accordion.php accepts a ‘titlehtmltag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a...

CVE-2021-24203: Improper Neutralization of Input During Web Page Generation

In the Elementor Website Builder WordPress plugin before 3.1.4, the divider widget includes/widgets/divider.php accepts an ‘htmltag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified...

CVE-2021-24202: Improper Neutralization of Input During Web Page Generation

In the Elementor Website Builder WordPress plugin before 3.1.4, the heading widget includes/widgets/heading.php accepts a ‘headersize’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modifie...

PT-2021-15746

Name of the Vulnerable Software and Affected Versions: Elementor Website Builder WordPress plugin versions prior to 3.1.4 Description: The issue concerns the column element in the Elementor Website Builder WordPress plugin, where a user with Contributor or above permissions can manipulate the htm...

CVE-2021-24205: Improper Neutralization of Input During Web Page Generation

In the Elementor Website Builder WordPress plugin before 3.1.4, the icon box widget includes/widgets/icon-box.php accepts a ‘titlesize’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modifi...

PT-2021-15751

Name of the Vulnerable Software and Affected Versions: Elementor Website Builder WordPress plugin versions prior to 3.1.4 Description: The issue allows a user with Contributor or above permissions to inject JavaScript into the title size parameter of the image box widget. This JavaScript is not...

CVE-2021-24201: Improper Neutralization of Input During Web Page Generation

In the Elementor Website Builder WordPress plugin before 3.1.4, the column element includes/elements/column.php accepts an ‘htmltag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified...

CVE-2021-24206: Improper Neutralization of Input During Web Page Generation

In the Elementor Website Builder WordPress plugin before 3.1.4, the image box widget includes/widgets/image-box.php accepts a ‘titlesize’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a...

VulnCheck KEV: CVE-2021-24204

In the Elementor Website Builder WordPress plugin before 3.1.4, the accordion widget includes/widgets/accordion.php accepts a ‘titlehtmltag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a...

CVE-2020-36171

The Elementor Website Builder plugin before 3.0.14 for WordPress does not properly restrict SVG uploads...

CVE-2020-36171

The Elementor Website Builder plugin before 3.0.14 for WordPress does not properly restrict SVG uploads...

CVE-2020-36171

The Elementor Website Builder plugin before 3.0.14 for WordPress does not properly restrict SVG uploads...

CVE-2020-36171: Improper Neutralization of Input During Web Page Generation

The Elementor Website Builder plugin before 3.0.14 for WordPress does not properly restrict SVG uploads...

PT-2021-11951

Name of the Vulnerable Software and Affected Versions: Elementor Website Builder plugin versions prior to 3.0.14 Description: The issue concerns the Elementor Website Builder plugin for WordPress, which does not properly restrict SVG uploads. This could potentially lead to security issues, althou...