WordPress Plugin Vulnerabilities

Unlimited Elements For Elementor < 1.5.67 - Contributor+ Arbitrary File Upload

Description

The plugin does not validate files in its file manager feature, allowing users with a role of contributor and above to upload arbitrary files

Affects Plugins

Plugin icon
unlimited-elements-for-elementor
Fixed in 1.5.67

References

CVE
CVE-2023-3295

Miscellaneous

Original Researcher
Chloe Chamberland
Verified
No
WPVDB ID
b341bb01-52bc-47df-9546-bb9d53ec0fac

Timeline

Publicly Published
2023-06-16 (about 2 years ago)
Added
2023-06-19 (about 2 years ago)
Last Updated
2023-06-19 (about 2 years ago)

Other

Published
Title
Published
2024-10-14
Title
Digital Lottery <= 3.0.5 - Unauthenticated Arbitrary File Upload
Published
2025-04-14
Title
JS Job Manager <= 2.0.2 - Unauthenticated Arbitrary File Upload
Published
2026-01-06
Title
WP Enable WebP <= 1.0 - Authenticated (Author+) Arbitrary File Upload
Published
2025-12-04
Title
Featured Image via URL <= 0.1 - Authenticated (Contributor+) Arbitrary FIle Upload
Published
2014-12-11
Title
WP Symposium <= 14.11 - Unauthenticated Shell Upload