CVE-2021-4446mediumexplotación observadaCWE-862

CVE-2021-4446: fallo de gravedad media en wpdevteam Essential Addons for Elementor…

Essential Addons for Elementor <= 4.6.4 - Missing Authorization

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Essential Addons for Elementor – Popular Elementor Templates & Widgets

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

35Vexday Risk Score

Prioriza la corrección. Ella explotación observada por VulnCheck.

ssvc Attendcvss 6.3epss 0.3%
de la publicación al arma
Publicada en NVD16 oct
VulnCheck15 oct
The Essential Addons for Elementor plugin for WordPress is vulnerable to authorization bypass in versions up to and including 4.6.4 due to missing capability checks and nonce disclosure. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to perform many unauthorized actions such as changing settings and installing arbitrary plugins.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Productos afectados
wpdevteam · Essential Addons for Elementor – Popular Elementor Templates & Widgets
CVEs relacionadas — wpdevteam Essential Addons for Elementor…

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-7665MEDIUMEssential Addons for Elementor <= 6.6.4 - Missing Authorization to Unauthenticated Information Exposure via 'load_more' AJAX HandlerEPSS 6.8%CVE-2024-3018HIGHEssential Addons for Elementor <= 5.9.13 - Authenticated (Author+) PHP Object Injection via error_resetpasswordEPSS 0.8%CVE-2026-15155HIGHEssential Addons for Elementor <= 6.6.10 - Authenticated (Contributor+) Account Takeover via Email Header InjectionEPSS 0.7%CVE-2024-4156MEDIUMEssential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.17 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.6%CVE-2023-3779MEDIUMEssential Addons For Elementor <=5.8.1 - Unauthenticated MailChimp API Key DisclosureEPSS 0.6%CVE-2024-3728MEDIUMEssential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery & Interactive CircleEPSS 0.6%