Posimyth The Plus Addons For Elementor vulnerabilities

CVE-2021-24175 [CRITICAL] CWE-287 CVE-2021-24175: The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.7 was being actively exploite The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.7 was being actively exploited to by malicious actors to bypass authentication, allowing unauthenticated users to log in as any user (including admin) by just providing the related username, as well as create accounts with arbitrary roles, such as admin. These issues can be exp

CVE-2021-4332 [MEDIUM] CWE-73 CVE-2021-4332: The Plus Addons for Elementor plugin for WordPress is vulnerable to arbitrary file reads in versions The Plus Addons for Elementor plugin for WordPress is vulnerable to arbitrary file reads in versions up to, and including 4.1.9 (pro) and 2.0.6 (free). The plugin has a feature to add an "Info Box" to an Elementor created page. This Info Box can include an SVG image for the box. Unfortunately, the plugin used file_get_contents with no verification that

CVE-2024-43932 [HIGH] CWE-862 CVE-2024-43932: Missing Authorization vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite the- Missing Authorization vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through <= 5.6.2.

CVE-2021-24351 [MEDIUM] CWE-79 CVE-2021-24351: The theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder WordPress plugin bef The theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.12 did not properly sanitise some of its fields, leading to a reflected Cross-Site Scripting (exploitable on both unauthenticated and authenticated users)

CVE-2021-24358 [MEDIUM] CWE-601 CVE-2021-24358: The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.10 did not validate a redirec The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.10 did not validate a redirect parameter on a specifically crafted URL before redirecting the user to it, leading to an Open Redirect issue.

CVE-2021-24949 [CRITICAL] CWE-89 CVE-2021-24949: The "WP Search Filters" widget of The Plus Addons for Elementor - Pro WordPress plugin before 5.0.7 The "WP Search Filters" widget of The Plus Addons for Elementor - Pro WordPress plugin before 5.0.7 does not sanitise and escape the option parameter before using it in a SQL statement, which could lead to SQL injection

CVE-2021-4331 [HIGH] CWE-862 CVE-2021-4331: The Plus Addons for Elementor plugin for WordPress is vulnerable to privilege escalation in versions The Plus Addons for Elementor plugin for WordPress is vulnerable to privilege escalation in versions up to, and including 4.1.9 (pro) and 2.0.6 (free). The plugin adds a registration form to the Elementor page builders functionality. As part of the registration form, users can choose which role to set as the default for users upon registration. This fie

CVE-2024-5455 [HIGH] CWE-98 CVE-2024-5455: The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Local File Inclusio The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.5.4 via the 'magazine_style' parameter within the Dynamic Smart Showcase widget. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files o

CVE-2024-2203 [HIGH] CWE-22 CVE-2024-2203: The The Plus Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all The The Plus Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.4.1 via the Clients widget. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those f

CVE-2023-47178 [CRITICAL] CWE-22 CVE-2023-47178: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in POSI Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in POSIMYTH Innovation The Plus Addons for Elementor Pro allows PHP Local File Inclusion.This issue affects The Plus Addons for Elementor Pro: from n/a through 5.2.8.

CVE-2021-24948 [HIGH] CWE-200 CVE-2021-24948: The Plus Addons for Elementor - Pro WordPress plugin before 5.0.7 does not validate the qvquery para The Plus Addons for Elementor - Pro WordPress plugin before 5.0.7 does not validate the qvquery parameter of the tp_get_dl_post_info_ajax AJAX action, which could allow unauthenticated users to retrieve sensitive information, such as private and draft posts

CVE-2024-2210 [MEDIUM] CWE-22 CVE-2024-2210: The The Plus Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all The The Plus Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.4.1 via the Team Member Listing widget. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP c

CVE-2021-24359 [MEDIUM] CVE-2021-24359: The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.11 did not properly check tha The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.11 did not properly check that a user requesting a password reset was the legitimate user, allowing an attacker to send an arbitrary reset password email to a registered user on behalf of the WordPress site. Such issue could be chained with an open redirect (CVE-2021-24358) in version be

CVE-2024-4484 [MEDIUM] CWE-79 CVE-2024-4484: The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerc The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘xai_username’ parameter in versions up to, and including, 5.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, w

CVE-2024-0445 [MEDIUM] CWE-79 CVE-2024-0445: The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's element attributes in all versions up to, and including, 5.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor access or higher to inject arbitrary web script

CVE-2024-3199 [MEDIUM] CWE-79 CVE-2024-3199: The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the countdown widget in all versions up to, and including, 5.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in page

CVE-2024-3718 [MEDIUM] CVE-2024-3718: The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's widgets all versions up to, and including, 5.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to i

CVE-2024-11829 [MEDIUM] CWE-79 CVE-2024-11829: The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerc The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Widget's searchable_label parameter in all versions up to, and including, 6.1.8 due to insufficient input sanitization and output escaping. This makes it possible for aut

CVE-2024-43977 [MEDIUM] CWE-79 CVE-2024-43977: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder allows Stored XSS.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through <= 5.6.2.

CVE-2024-3197 [MEDIUM] CWE-79 CVE-2024-3197: The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom attributes in the plugin's widgets in all versions up to, and including, 5.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level ac