CVE-2025-6253highCWE-862

CVE-2025-6253: fallo de gravedad alta en UiCore Elements – Free widgets and templates…

UiCore Elements <= 1.3.0 - Missing Authorization to Unauthenticated Arbitrary File Read

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear UiCore Elements – Free widgets and templates for Elementor

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 0.4%
The UiCore Elements – Free Elementor widgets and templates plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.3.0 via the prepare_template() function due to a missing capability check and insufficient controls on the filename specified. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Productos afectados
uicore · UiCore Elements – Free widgets and templates for Elementor
CVEs relacionadas — UiCore Elements – Free widgets and templates…

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-1054MEDIUMUiCore Elements – Free Elementor widgets and templates <= 1.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsEPSS 0.3%