CVE-2021-24258

The Elements Kit Lite and Elements Kit Pro WordPress plugins, in versions before 2.2.0 , are vulnerable to stored Cross-Site Scripting (XSS) . This vulnerability affects a number of widgets and can be exploited by lower-privileged users, such as contributors, using a similar method to execute mal...

CVE-2024-2047

The CVE-2024-2047 entry affects ElementsKit Elementor addons and Templates Library (ElementsKit Lite) for WordPress. The root cause is Local File Inclusion via render_raw in all versions up to 3.0.6. This allows an authenticated attacker with contributor+ privileges to include and execute arbitra...

CVE-2024-10091

CVE-2024-10091 — ElementsKit Elementor addons (WordPress) stores cross-site scripting via the Image Comparison Widget in versions

CVE-2024-37255

CVE-2024-37255 corresponds to a Missing Authorization vulnerability in Wpmet Elements Kit Elementor addons (ElementsKit Lite)

CVE-2024-6455

The ElementsKit Elementor addons plugin for WordPress is vulnerable to Information Exposure in all versions up to and including 3.2.0 . The root cause is a missing capability check on the ekit_widgetarea_content function. This flaw allows unauthenticated attackers to view any items created in Ele...

CVE-2024-32505

CVE-2024-32505 affects the WordPress ElementsKit Elementor addons plugin (versions

CVE-2024-1239

CVE-2024-1239 affects ElementsKit Elementor addons for WordPress and is a Stored XSS vulnerability present in all versions up to 3.0.4 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor access or higher can inject arbitrary script that executes in...

CVE-2023-6582

CVE-2023-6582 affects ElementsKit Lite/Elementor addon for WordPress. The vulnerability is an unauthenticated Sensitive Information Exposure via the ekit_widgetarea_content function, allowing attackers to read posts in draft, private, or pending status when posts are created with Elementor. Affec...

CVE-2024-2042

CVE-2024-2042 is a Stored XSS affecting the ElementsKit Elementor addons plugin for WordPress, via the Image Accordion widget. It affects all versions up to and including 3.0.5 due to insufficient input sanitization and output escaping, enabling authenticated attackers with contributor-level acce...

CVE-2023-39993

CVE-2023-39993 refers to a Broken Access Control issue in the WordPress plugin ElementsKit Lite / Elementor addons . Affected versions are ≤ 2.9.0 (Wpmet ElementsKit Lite). The root cause is a Missing Authorization/Access control weakness that could allow unauthorized actions. Remediation: upgrad...

CVE-2024-1238

CVE-2024-1238 affects ElementsKit Elementor addons and Templates Library for WordPress. It is a Stored XSS via the button ID parameter caused by insufficient input sanitization and output escaping, impacting all versions up to 3.0.6. Exploitation requires authentication (contributors+). Reported ...

CVE-2024-3499

The CVE-2024-3499 entry concerns ElementsKit Elementor addons and Templates Library for WordPress. Impact arises from a Local File Inclusion in the Onepage Scroll module’s generate_navigation_markup function, enabling an authenticated attacker with contributor+ privileges to include and execute a...

CVE-2024-2803

CVE-2024-2803 corresponds to ElementsKit Elementor addons and Templates Library in WordPress, where Stored XSS via the countdown widget exists in all versions up to 3.0.6 due to insufficient input sanitization and output escaping. The vulnerability allows authenticated attackers with contributor-...