SEGURIDAD DE PLUGINS
Vulnerabilidades conocidas, compatibilidad con PHP y alternativas más seguras para el plugin de WordPress Elementskit — verificado contra la base de datos de seguridad local de WP Clinic.
elementskitelementor addonelementor addonselementor widgetsheader footer buildermega menu builder
11 CVEs conocidos registrados para Elementskit.
| CVE | Vulnerabilidad | Tipo | Gravedad | Afectadas | Corregido en | Publicado | Estado |
|---|---|---|---|---|---|---|---|
| CVE-2024-43996 | ElementsKit [elementskit] < 3.6.8 | Limitación incorrecta de una ruta a un directorio restringido (Path Traversal) | Media 6,5 | < 3.6.8 | 3.6.8 | 2024-08-29 | — |
| CVE-2024-7064 | ElementsKit [elementskit] < 3.6.6 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 3.6.6 | 3.6.6 | 2024-08-14 | — |
| CVE-2024-7063 | ElementsKit [elementskit] < 3.6.7 | Exposición de información sensible a un actor no autorizado | Media 4,3 | < 3.6.7 | 3.6.7 | 2024-08-14 | — |
| CVE-2024-5263 | ElementsKit [elementskit] < 3.6.3 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 3.6.3 | 3.6.3 | 2024-06-14 | — |
| CVE-2024-4404 | ElementsKit [elementskit] < 3.6.3 | Falsificación de petición del lado del servidor (SSRF) | Crítica 9,6 | < 3.6.3 | 3.6.3 | 2024-06-13 | — |
| CVE-2024-4452 | ElementsKit [elementskit] < 3.6.2 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 3.6.2 | 3.6.2 | 2024-05-20 | — |
| CVE-2024-3500 | ElementsKit [elementskit] < 3.6.1 | Control incorrecto del nombre de archivo en una sentencia include/require de PHP (inclusión remota de archivos PHP / RFI) | Alta 8,8 | < 3.6.1 | 3.6.1 | 2024-04-25 | — |
| CVE-2024-3598 | ElementsKit [elementskit] < 3.6.1 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 3.6.1 | 3.6.1 | 2024-04-18 | — |
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ElementsKit ElementsKit Pro allows PHP Local File Inclusion.This issue affects ElementsKit Pro: from n/a through 3.6.0.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The ElementsKit Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.6 via the 'render_raw' function. This can allow authenticated attackers, with Contributor-level permissions and above, to extract sensitive data including private, future, and draft posts.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Motion Text and Table widgets in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The ElementsKit PRO plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.6.2 via the 'render_raw' function. This can allow authenticated attackers, with contributor-level permissions and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in versions up to, and including, 3.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The ElementsKit Pro plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.6.0 via the Price Menu, Hotspot, and Advanced Toggle widgets. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. CVE-2024-43996 is potentially a duplicate of this issue.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Creative Button widget in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
| CVE | Vulnerabilidad | Tipo | Gravedad | Afectadas | Corregido en | Publicado | Estado |
|---|---|---|---|---|---|---|---|
| CVE-2023-39993 | ElementsKit [elementskit] < 3.6.8 | Falta de control de autorización | Media 4,3 | < 3.6.8 | 3.6.8 | 2023-11-13 | — |
| CVE-2021-24258 | ElementsKit [elementskit] < 2.2.0 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 2.2.0 | 2.2.0 | 2021-04-13 | — |
| CVE-2025-0321 | ElementsKit [elementskit] < 3.7.9 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 3.7.9 | 3.7.9 | 0000-00-00 | — |
No patched version is available. Rafie Muhammad (Patchstack) discovered and reported this Broken Access Control vulnerability in WordPress ElementsKit Pro Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has not been known to be fixed yet.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
The Elements kit lite and Elements kit pro WordPress Plugins < 2.2.0 have a number of widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method. The “fun fact” widget accepts an “ekit_funfact_title_size” parameter. Although the element control lists a fixed set of possible html tags, it is possible to send a ‘save_builder’ request containing JavaScript in the ‘ekit_funfact_title_size’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed. The heading widget (includes/widgets/heading.php) accepts ‘ekit_heading_title_tag’ and ‘ekit_heading_sub_title_tag’ parameters. When sending a ‘save_builder’ request, these parameters can be set to ‘script’ and combined with the ‘ekit_heading_title’ or ‘ekit_heading_sub_title’ parameters containing JavaScript - although the ‘ekit_heading_sub_title’ parameter is escaped, this is trivial to overcome since the actual scripting tags are added in the ‘ekit_heading_sub_title_tag’. The icon box (includes/widgets/icon-box.php) widget accepts a ‘ekit_icon_box_title_size’ parameter. It is possible to send a modified ‘save_builder’ request containing JavaScript in the ‘ekit_icon_box_title_size’ parameter for this widget, which is not filtered and is output without escaping. Similarly, the image box (widgets/image-box/image-box.php) widget accepts an ‘ekit_image_box_title_size’ parameter. It is possible to send a modified ‘save_builder’ request containing JavaScript in the ‘ekit_image_box_title_size’ parameter for this widget, which is not filtered and is output without escaping. The pricing (widgets/pricing/pricing.php) widget accepts a ‘ekit_pricing_title_size’ parameter. When sending a ‘save_builder’ request, it is possible to set the ‘ekit_pricing_title_size’ parameter to ‘script’ and populate the ‘ekit_pricing_table_title’ parameter with Javascript - although the ‘ekit_pricing_table_title’ parameter is escrped, this is trivial to overcome since the actual script tag is added in the ‘ekit_pricing_title_size’ parameter. Finally, impacting the pro version only, the motion text (widgets/motion-text/motion-text.php) widget accepts a ‘ekit_motion_text_sub_title_tag’ parameter. It is possible to send a ‘save_builder’ request containing JavaScript in the ‘ekit_motion_text_sub_title_tag’ parameter, which is not filtered and is output without escaping. Each of these issues can be abused by a lower-privileged user, such as a contributor, to add malicious JavaScript to a post, which would then be executed in the browser of any user previewing that post. It is common for administrators or editors to preview the posts of users without publishing permissions before publishing their content.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: WPScan
The ElementsKit Pro plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
Actualiza este plugin a la última versión de wordpress.org — cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en") cuando hay una registrada.
Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.
Ejecuta un escaneo pasivo gratis ahora, o crea una cuenta gratuita e instala el plugin de WP Clinic para un escaneo profundo de toda tu cuenta de hosting y reparación asistida por IA.