CVE-2024-1358highCWE-22

CVE-2024-1358: high-severity vulnerability in wpvibes Addon Elements for Elementor (formerly…

Elementor Addon Elements <= 1.12.12 - Directory Traversal to Local File Inclusion

Published · Updated

Follow this CVE+ Monitor Addon Elements for Elementor

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 1.2%
The Elementor Addon Elements plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.12.12 via the render function. This makes it possible for authenticated attackers, with contributor access or higher, to include the contents of arbitrary PHP files on the server, which may expose sensitive information.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
wpvibes · Addon Elements for Elementor (formerly Elementor Addon Elements)
Related CVEs — wpvibes Addon Elements for Elementor (formerly…

In the same product, most dangerous first.

CVE-2023-4723MEDIUMElementor Addon Elements <= 1.12.7 - Missing Authorization to Sensitive Information ExposureEPSS 0.9%CVE-2024-3743MEDIUMElementor Addon Elements <= 1.13.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.6%CVE-2024-13215MEDIUMElementor Addon Elements <= 1.13.10 - Authenticated (Contributor+) Sensitive Information Exposure via Modal PopupEPSS 0.5%CVE-2024-2091MEDIUMElementor Addon Elements <= 1.13.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-1392MEDIUMElementor Addon Elements <= 1.12.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dual Button WidgetEPSS 0.5%CVE-2024-1393MEDIUMElementor Addon Elements <= 1.12.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Content Switcher WidgetEPSS 0.5%