Recent Vulnerabilities Research Posts Trends Blog About Contact

Published: 07/03/2023 Updated: 07/11/2023

CVSS v3 Base Score: 6.5 | Impact Score: 3.6 | Exploitability Score: 2.8

VMScore: 0

The Plus Addons for Elementor plugin for WordPress is vulnerable to arbitrary file reads in versions up to, and including 4.1.9 (pro) and 2.0.6 (free). The plugin has a feature to add an "Info Box" to an Elementor created page. This Info Box can include an SVG image for the box. Unfortunately, the plugin used file_get_contents with no verification that the file being supplied was an SVG file, so any user with access to the Elementor page builder, such as contributors, could read arbitrary files on the WordPress installation.

Vulnerable Product	Search on Vulmon	Subscribe to Product
posimyth the plus addons for elementor

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2523506%40the-plus-addons-for-elementor-page-builder&new=2523506%40the-plus-addons-for-elementor-page-builder&sfp_email=&sfph_mail=https://www.wordfence.com/threat-intel/vulnerabilities/id/aa698e7e-b1c7-4ead-aa2e-7fbfc9dfac80 https://nvd.nist.gov

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2021-4332

Vulnerability Summary

Vulnerability Trend

References

Vulmon Search

About

Products

Connect