CVE-2021-24358
published 2021-06-14CVE-2021-24358: The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.10 did not validate a redirect parameter on a specifically crafted URL before…
PriorityP336medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EXPLOIT
EPSS
2.30%
81.1th percentile
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.10 did not validate a redirect parameter on a specifically crafted URL before redirecting the user to it, leading to an Open Redirect issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| posimyth | the_plus_addons_for_elementor | < 4.1.11 | 4.1.11 |
| posimyth | the_plus_addons_for_elementor | < 4.1.10 | 4.1.10 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-37f5-h3rf-vphw: The Plus Addons for Elementor Page Builder WordPress plugin before 4
ghsa_unreviewed·2022-05-24·CVSS 6.1
CVE-2021-24359 [MEDIUM] CWE-284 GHSA-37f5-h3rf-vphw: The Plus Addons for Elementor Page Builder WordPress plugin before 4
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.11 did not properly check that a user requesting a password reset was the legitimate user, allowing an attacker to send an arbitrary reset password email to a registered user on behalf of the WordPress site. Such issue could be chained with an open redirect (CVE-2021-24358) in version below 4.1.10, to include a crafted password reset link in the email, which would lead to an account takeover.
GHSA
GHSA-f6gp-7xm9-vqm8: The Plus Addons for Elementor Page Builder WordPress plugin before 4
ghsa_unreviewed·2022-05-24
CVE-2021-24358 [MEDIUM] CWE-601 GHSA-f6gp-7xm9-vqm8: The Plus Addons for Elementor Page Builder WordPress plugin before 4
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.10 did not validate a redirect parameter on a specifically crafted URL before redirecting the user to it, leading to an Open Redirect issue.
No detection rules found.
Nuclei
Plus Addons for Elementor Page Builder < 4.1.10 - Open Redirect
nuclei·CVSS 6.1
CVE-2021-24358 [MEDIUM] Plus Addons for Elementor Page Builder < 4.1.10 - Open Redirect
Plus Addons for Elementor Page Builder ([A-Za-z0-9]+)'
internal: true
part: body
- type: regex
name: username
group: 1
regex:
- 'ion: https:\/\/[a-z0-9.]+\/author\/([a-z]+)\/'
internal: true
part: header
# digest: 490a0046304402203211ab9085159966d4a9434043de7dccf34c3dc02f8b886100857256e19a189202206548ac41389b1d3f590984286b3ad6a12decf91d5775597aef3a25a8d6403c31:922c64590222798bb761d5b6d8e72950
No writeups or analysis indexed.
2021-06-14
Published