CVE-2021-24351CWE-79

CVE-2021-24351: fallo en The Plus Addons for Elementor Page Builder

The Plus Addons for Elementor < 4.1.12 - Reflected Cross-Site Scripting (XSS)

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear The Plus Addons for Elementor Page Builder

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

18Vexday Risk Score

Corrige pronto. Ella tiene exploit funcional público.

ssvc Attendepss 2.5%
The theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.12 did not properly sanitise some of its fields, leading to a reflected Cross-Site Scripting (exploitable on both unauthenticated and authenticated users)
Productos afectados
Unknown · The Plus Addons for Elementor Page Builder
CVEs relacionadas — The Plus Addons for Elementor Page Builder

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-24175—The Plus Addons for Elementor Page Builder < 4.1.7 - Authentication BypassEPSS 17.2%CVE-2021-24358—The Plus Addons for Elementor Page Builder < 4.1.10 - Open RedirectEPSS 2.3%CVE-2021-24359—The Plus Addons for Elementor Page Builder < 4.1.11 - Arbitrary Reset Pwd Email SendingEPSS 1.1%