CVE-2025-8151: fallo de gravedad media en devitemsllc HT Mega Addons for Elementor…
HT Mega – Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Path Traversal to Limited Arbitrary CSS File Actions
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.3epss 0.5%
The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.9.1 via the 'save_block_css' function. This makes it possible for authenticated attackers, with Author-level access and above, to create CSS files in any directory, and delete CSS files in any directory in a Windows environment.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Productos afectados
devitemsllc · HT Mega Addons for Elementor – Elementor Widgets & Template BuilderCVEs relacionadas — devitemsllc HT Mega Addons for Elementor…
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-1974HIGHHT Mega – Absolute Addons For Elementor <= 2.4.5 - Authenticated (Contributor+) Directory TraversalEPSS 1.2%CVE-2024-4875MEDIUMHT Mega – Absolute Addons For Elementor <= 2.5.2 - Missing Authorization to Options UpdateEPSS 0.8%CVE-2023-6214HIGHHT Mega – Absolute Addons For Elementor <= 2.4.6 - Sensitive Information Exposure via purchased_productsEPSS 0.6%CVE-2024-1397MEDIUMHT Mega <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleTagEPSS 0.5%CVE-2024-3990MEDIUMHT Mega – Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip & Popover WidgetEPSS 0.4%CVE-2024-3308MEDIUMHT Mega – Absolute Addons For Elementor <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Grid WidgetEPSS 0.4%