CVE-2024-1567highCWE-434

CVE-2024-1567: fallo de gravedad alta en wproyal Royal Addons for Elementor – Addons…

Royal Elementor Addons and Templates <= 1.3.94 - Unauthenticated Limited File Upload

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Royal Addons for Elementor – Addons and Templates Kit for Elementor

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.2epss 1.1%
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to limited file uploads due to missing file type validation in the 'file_validity' function in all versions up to, and including, 1.3.94. This makes it possible for unauthenticated attackers to upload dangerous file types such as .svgz on the affected site's server which may make cross-site scripting or remote code execution possible.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Productos afectados
wproyal · Royal Addons for Elementor – Addons and Templates Kit for Elementor
CVEs relacionadas — wproyal Royal Addons for Elementor – Addons…

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-4703MEDIUMRoyal Elementor Addons <= 1.3.59 - Insufficient Access Control to Import DeletionEPSS 1.0%CVE-2022-4700MEDIUMRoyal Elementor Addons <= 1.3.59 - Insufficient Access Control to Theme ActivationEPSS 0.9%CVE-2022-4704MEDIUMRoyal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template ImportEPSS 0.8%CVE-2022-4702MEDIUMRoyal Elementor Addons <= 1.3.59 - Insufficient Access Control to Plugin DeactivationEPSS 0.8%CVE-2022-4701MEDIUMRoyal Elementor Addons <= 1.3.59 - Insufficient Access Control to Plugin ActivationEPSS 0.8%CVE-2022-4710MEDIUMRoyal Elementor Addons <= 1.3.59 - Reflected Cross-Site ScriptingEPSS 0.8%