CVE-2021-4446mediumexploração observadaCWE-862

CVE-2021-4446: falha de média gravidade em wpdevteam Essential Addons for Elementor…

Essential Addons for Elementor <= 4.6.4 - Missing Authorization

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Essential Addons for Elementor – Popular Elementor Templates & Widgets

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

35Vexday Risk Score

Priorize a correção. Ela exploração observada pelo VulnCheck.

ssvc Attendcvss 6.3epss 0.3%
da publicação à arma
Publicada no NVD16 de out.
VulnCheck15 de out.
The Essential Addons for Elementor plugin for WordPress is vulnerable to authorization bypass in versions up to and including 4.6.4 due to missing capability checks and nonce disclosure. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to perform many unauthorized actions such as changing settings and installing arbitrary plugins.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Produtos afetados
wpdevteam · Essential Addons for Elementor – Popular Elementor Templates & Widgets
CVEs relacionadas — wpdevteam Essential Addons for Elementor…

No mesmo produto, das mais perigosas para as menos.

CVE-2026-7665MEDIUMEssential Addons for Elementor <= 6.6.4 - Missing Authorization to Unauthenticated Information Exposure via 'load_more' AJAX HandlerEPSS 6.8%CVE-2024-3018HIGHEssential Addons for Elementor <= 5.9.13 - Authenticated (Author+) PHP Object Injection via error_resetpasswordEPSS 0.8%CVE-2026-15155HIGHEssential Addons for Elementor <= 6.6.10 - Authenticated (Contributor+) Account Takeover via Email Header InjectionEPSS 0.7%CVE-2024-4156MEDIUMEssential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.17 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.6%CVE-2023-3779MEDIUMEssential Addons For Elementor <=5.8.1 - Unauthenticated MailChimp API Key DisclosureEPSS 0.6%CVE-2024-3728MEDIUMEssential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery & Interactive CircleEPSS 0.6%