CVE-2021-24201: falha em Elementor Website Builder
Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Column Element
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 0.7%
In the Elementor Website Builder WordPress plugin before 3.1.4, the column element (includes/elements/column.php) accepts an ‘html_tag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘html_tag’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
Produtos afetados
Unknown · Elementor Website BuilderCVEs relacionadas — Elementor Website Builder
No mesmo produto, das mais perigosas para as menos.
CVE-2021-24891—Elementor < 3.4.8 - DOM Cross-Site-ScriptingEPSS 28.9%CVE-2023-0329HIGHElementor Website Builder < 3.12.2 - Admin+ SQLiEPSS 19.7%CVE-2022-4953—Elementor < 3.5.5 - Iframe InjectionEPSS 3.4%CVE-2021-24205—Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Icon Box WidgetEPSS 0.8%CVE-2021-24204—Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Accordion WidgetEPSS 0.7%CVE-2021-24203—Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Divider WidgetEPSS 0.7%