CVE-2023-6582mediumCWE-284

CVE-2023-6582: medium-severity vulnerability in roxnor ElementsKit Elementor Addons – Advanced…

ElementsKit Lite <= 3.0.3 - Unauthenticated Sensitive Information Exposure

Published · Updated

Follow this CVE+ Monitor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.5%
The ElementsKit Elementor addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.3 via the ekit_widgetarea_content function. This makes it possible for unauthenticated attackers to obtain contents of posts in draft, private or pending review status that should not be visible to the general public. This applies to posts created with Elementor only.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
roxnor · ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
Related CVEs — roxnor ElementsKit Elementor Addons – Advanced…

In the same product, most dangerous first.

CVE-2024-2047HIGHElementsKit Elementor addons <= 3.0.6 - Authenticated (Contributor+) Local File Inclusion in render_rawEPSS 1.5%CVE-2024-3499HIGHElementsKit Elementor addons <= 3.1.0 - Authenticated (Contributor+) Local File Inclusion via Onepage Scroll ModuleEPSS 1.1%CVE-2025-0968MEDIUMElementsKit Elementor addons <= 3.4.0 - Unauthenticated Information Exposure via get_megamenu_content FunctionEPSS 0.5%CVE-2024-2042MEDIUMElementsKit Elementor addons <= 3.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion WidgetEPSS 0.5%CVE-2024-8546MEDIUMElementsKit Elementor addons <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video WidgetEPSS 0.4%CVE-2023-6525MEDIUMElementsKit Elementor addons <= 3.0.3 - Authenticated(Editor+) Stored Cross-Site ScriptingEPSS 0.4%