WordPress Plugin Vulnerabilities
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) < 1.5.103 - Admin+ Command Injection
Description
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to command injection in all versions up to, and including, 1.5.102. This is due to insufficient filtering of template attributes during the creation of HTML for custom widgets This makes it possible for authenticated attackers, with administrator-level access and above, to execute arbitrary commands on the server.
Affects Plugins
Fixed in 1.5.103 References
Classification
Type
COMMAND INJECTION
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
wesley (wcraft)
Verified
No
WPVDB ID
Timeline
Publicly Published
2024-05-09 (about 2 years ago)
Added
2024-05-09 (about 2 years ago)
Last Updated
2024-10-01 (about 1 year ago)
WPScan 