CVE-2021-24891CWE-79

CVE-2021-24891: falha em Elementor Website Builder

Elementor < 3.4.8 - DOM Cross-Site-Scripting

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Elementor Website Builder

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

23Vexday Risk Score

Corrija em breve. Ela tem exploit funcional público.

ssvc Attendepss 29%
The Elementor Website Builder WordPress plugin before 3.4.8 does not sanitise or escape user input appended to the DOM via a malicious hash, resulting in a DOM Cross-Site Scripting issue.
Produtos afetados
Unknown · Elementor Website Builder
CVEs relacionadas — Elementor Website Builder

No mesmo produto, das mais perigosas para as menos.

CVE-2023-0329HIGHElementor Website Builder < 3.12.2 - Admin+ SQLiEPSS 19.7%CVE-2022-4953—Elementor < 3.5.5 - Iframe InjectionEPSS 3.4%CVE-2021-24205—Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Icon Box WidgetEPSS 0.8%CVE-2021-24204—Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Accordion WidgetEPSS 0.7%CVE-2021-24201—Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Column ElementEPSS 0.7%CVE-2021-24203—Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Divider WidgetEPSS 0.7%