CVE-2025-0968mediumCWE-284

CVE-2025-0968: falha de média gravidade em roxnor ElementsKit Elementor Addons – Advanced…

ElementsKit Elementor addons <= 3.4.0 - Unauthenticated Information Exposure via get_megamenu_content Function

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.5%
The ElementsKit Elementor addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.0 due to a missing capability checks on the get_megamenu_content() function. This makes it possible for unauthenticated attackers to view any item created in Elementor, such as posts, pages and templates including drafts, trashed and private items.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
roxnor · ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
CVEs relacionadas — roxnor ElementsKit Elementor Addons – Advanced…

No mesmo produto, das mais perigosas para as menos.

CVE-2024-2047HIGHElementsKit Elementor addons <= 3.0.6 - Authenticated (Contributor+) Local File Inclusion in render_rawEPSS 1.5%CVE-2024-3499HIGHElementsKit Elementor addons <= 3.1.0 - Authenticated (Contributor+) Local File Inclusion via Onepage Scroll ModuleEPSS 1.1%CVE-2023-6582MEDIUMElementsKit Lite <= 3.0.3 - Unauthenticated Sensitive Information ExposureEPSS 0.5%CVE-2024-2042MEDIUMElementsKit Elementor addons <= 3.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion WidgetEPSS 0.5%CVE-2024-8546MEDIUMElementsKit Elementor addons <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video WidgetEPSS 0.4%CVE-2023-6525MEDIUMElementsKit Elementor addons <= 3.0.3 - Authenticated(Editor+) Stored Cross-Site ScriptingEPSS 0.4%