WordPress Plugin Vulnerabilities

Elementor < 3.0.14 - SVG Upload Allowed by Default

Description

The plugin allowed SVG files to be uploaded by default, which might lead to security issues, such as Cross-Site Scripting

Affects Plugins

Plugin icon
elementor
Fixed in 3.0.14

References

CVE
CVE-2020-36171

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.5 (medium)

Miscellaneous

Verified
No
WPVDB ID
5c5f44e1-c00b-4a90-a581-ef06765b7f66

Timeline

Publicly Published
2021-01-06 (about 3 years ago)
Added
2021-01-06 (about 3 years ago)
Last Updated
2021-01-09 (about 3 years ago)

Other

Published
Title
Published
2022-08-22
Title
WBW Currency Switcher for WooCommerce < 1.6.6 - Admin+ Stored XSS
Published
2017-08-21
Title
Liveforms < 3.4.0 - XSS
Published
2012-01-09
Title
Yousaytoo Auto Publishing <= 1.0 - Cross Site Scripting
Published
2023-01-05
Title
CC Child Pages < 1.43 - Contributor+ Stored XSS via Shortcode
Published
2024-01-22
Title
Accelerated Mobile Pages < 1.0.93 - Unautenticated Reflected Cross-Site Scripting