CVE-2024-10050

CVE-2024-10050 affects Elementor Header & Footer Builder for WordPress up to version 1.6.43, enabling information disclosure via the hfe_template shortcode. Authenticated users with Contributor+ can view Draft, Private, and password‑protected posts they do not own. The vulnerability is documented...

CVE-2024-10050 Elementor Header & Footer Builder <= 1.6.43 - Authenticated (Contributor+) Information Disclosure via Shortcode

The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 1.6.43 via the hfetemplate shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to view the contents of Draft...

PT-2024-33654 · Unknown · Mycred Mycred Elementor

Name of the Vulnerable Software and Affected Versions: myCRED myCred Elementor versions 1.2.6 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations:...

WordPress Royal Elementor Addons Plugin <= 1.3.980 is vulnerable to XML External Entity (XXE)

Software Royal Elementor Addons Type Plugin Vulnerable versions = 1.3.980 Fixed in 1.3.981 OWASP Top 10 A3: Injection Classification XML External Entity XXE CVE CVE-2024-50442 Patch priority Low CVSS severity Low 6.5 Developer WProyal PSID d8b2b553fe8e Credits wcraft Required privilege Author...

WordPress Sky Addons for Elementor Plugin <= 2.5.15 is vulnerable to Cross Site Scripting (XSS)

Software Sky Addons for Elementor Type Plugin Vulnerable versions = 2.5.15 Fixed in 2.5.16 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-50433 Patch priority Low CVSS severity Low 6.5 Developer Shahidul Islam PSID e822cb05d3f7 Credits João Pedro S Alcântara Kinor...

WordPress plugin myCred Elementor 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress PDF Generator Addon for Elementor Page Builder Plugin <= 1.7.4 is vulnerable to Cross Site Scripting (XSS)

Software PDF Generator Addon for Elementor Page Builder Type Plugin Vulnerable versions = 1.7.4 Fixed in 1.7.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-50449 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 7f59036ae201 Credits João...

PT-2024-15998 · Elementor · Elementor Header & Footer Builder

Name of the Vulnerable Software and Affected Versions: Elementor Header & Footer Builder plugin for WordPress versions up to, and including, 1.6.43 Description: The issue allows authenticated attackers with Contributor-level access and above to view the contents of Draft, Private, and...

WordPress plugin Elementor Header & Footer Builder 信息泄露漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An information disclosure...

WordPress The Pack Elementor addons Plugin <= 2.0.9 is vulnerable to Local File Inclusion

Software The Pack Elementor addons Type Plugin Vulnerable versions = 2.0.9 Fixed in 2.1.0 OWASP Top 10 A1: Broken Access Control Classification Local File Inclusion CVE CVE-2024-50453 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID e424fb066139 Credits João Pedro S Alcânta...

WordPress Envo's Elementor Templates & Widgets for WooCommerce Plugin <= 1.4.19 is vulnerable to Cross Site Scripting (XSS)

Software Envo's Elementor Templates & Widgets for WooCommerce Type Plugin Vulnerable versions = 1.4.19 Fixed in 1.4.20 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-50447 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 28c4d14cb691 Credits...

WordPress Elementor Header & Footer Builder plugin <= 1.6.43 - Authenticated (Contributor+) Information Disclosure vulnerability

Authenticated Contributor+ Information Disclosure vulnerability discovered by Francesco Carlucci in WordPress Plugin Ultimate Addons for Elementor - Lite versions = 1.6.43...

CVE-2024-49676

Unrestricted Upload of File with Dangerous Type vulnerability in Michael Bourne Custom Icons for Elementor custom-icons-for-elementor allows Upload a Web Shell to a Web Server.This issue affects Custom Icons for Elementor: from n/a through = 0.3.3...

CVE-2024-49676 WordPress Custom Icons for Elementor plugin <= 0.3.3 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Michael Bourne Custom Icons for Elementor custom-icons-for-elementor allows Upload a Web Shell to a Web Server.This issue affects Custom Icons for Elementor: from n/a through = 0.3.3...

CVE-2024-49676 WordPress Custom Icons for Elementor plugin <= 0.3.3 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Michael Bourne Custom Icons for Elementor custom-icons-for-elementor allows Upload a Web Shell to a Web Server.This issue affects Custom Icons for Elementor: from n/a through = 0.3.3...

CVE-2024-49676

CVE-2024-49676 affects the WordPress plugin Custom Icons for Elementor up to version 0.3.3. It is an Unrestricted Upload of File with Dangerous Type vulnerability that allows uploading a Web Shell to the web server. Root cause: insufficient validation for uploaded files in the plugin, enabling ar...

CVE-2024-9530

The Qi Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.0 via private templates. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the...

CVE-2024-9530

The Qi Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.0 via private templates. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the...

CVE-2024-9530 Qi Addons For Elementor <= 1.8.0 - Sensitive Information Exposure

The Qi Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.0 via private templates. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the...

CVE-2024-9530 Qi Addons For Elementor <= 1.8.0 - Sensitive Information Exposure

The Qi Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.0 via private templates. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the...