CVE-2024-29792

published 2024-03-27

CVE-2024-29792: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free…

Priority P2 79 medium 6.1 CVSS 3.1

AV N AC L PR N UI R S C C L I L A N

ITW EXPLOIT VulnCheck KEV

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through <= 1.5.93.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
unlimited-elements	unlimited_elements_for_elementor	< 1.5.95	1.5.95

Detection & IOCs extracted from sources · hover to see the quote

• → Target plugin: Unlimited Elements For Elementor (Free Widgets, Addons, Templates), WordPress slug 'unlimited-elements-for-elementor', affected versions n/a through 1.5.93 (XSS vulnerability CVE-2024-29792) ↗
• → Sigma/detection rule condition targets the WordPress plugin 'unlimited-elements-for-elementor' — use this slug to detect exploitation attempts in web server logs or WAF telemetry

• · Rule digest provided but no full Sigma/Snort/YARA rule body is present in the source material; the digest alone is not actionable for detection deployment

CVSS provenance

nvd v3.1 6.1 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vulncheck 6.1 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79