+ 34 vulnerabilidades conocidas más
| CVE |
Vulnerabilidad |
Tipo |
Gravedad |
Afectadas |
Corregido en |
Publicado |
Estado |
|
CVE-2024-10266
|
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor] < 4.10.61 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,4
|
< 4.10.61
|
4.10.61 |
2024-10-28 |
✓ corregido en la última versión
|
|
CVE-2021-4445
|
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor] < 4.5.2 |
Falta de control de autorización |
Media
4,3
|
< 4.5.2
|
4.5.2 |
2024-10-16 |
✓ corregido en la última versión
|
|
CVE-2024-8681
|
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor] < 4.10.53 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
5,4
|
< 4.10.53
|
4.10.53 |
2024-09-26 |
✓ corregido en la última versión
|
|
CVE-2024-6824
|
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor] < 4.10.39 |
Falta de control de autorización |
Media
4,3
|
< 4.10.39
|
4.10.39 |
2024-08-07 |
✓ corregido en la última versión
|
|
CVE-2024-6495
|
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor] < 4.10.37 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
5,4
|
< 4.10.37
|
4.10.37 |
2024-07-11 |
✓ corregido en la última versión
|
|
CVE-2024-37922
|
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor] < 4.10.35 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,5
|
< 4.10.35
|
4.10.35 |
2024-07-09 |
✓ corregido en la última versión
|
|
CVE-2024-6434
|
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor] < 4.10.36 |
Consumo de recursos no controlado |
Media
4,3
|
< 4.10.36
|
4.10.36 |
2024-07-03 |
✓ corregido en la última versión
|
|
CVE-2024-6340
|
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor] < 4.10.36 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
5,4
|
< 4.10.36
|
4.10.36 |
2024-07-02 |
✓ corregido en la última versión
|
|
CVE-2024-5553
|
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor] < 4.10.34 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
5,4
|
< 4.10.34
|
4.10.34 |
2024-06-11 |
✓ corregido en la última versión
|
|
CVE-2024-4376
|
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor] < 4.10.32 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
5,4
|
< 4.10.32
|
4.10.32 |
2024-05-30 |
✓ corregido en la última versión
|
|
CVE-2024-4205
|
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor] < 4.10.32 |
Falta de control de autorización |
Media
4,3
|
< 4.10.32
|
4.10.32 |
2024-05-30 |
✓ corregido en la última versión
|
|
CVE-2024-4379
|
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor] < 4.10.32 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
5,4
|
< 4.10.32
|
4.10.32 |
2024-05-30 |
✓ corregido en la última versión
|
|
CVE-2024-4378
|
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor] < 4.10.32 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
5,4
|
< 4.10.32
|
4.10.32 |
2024-05-22 |
✓ corregido en la última versión
|
|
CVE-2024-4203
|
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor] < 4.10.31 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
5,4
|
< 4.10.31
|
4.10.31 |
2024-04-29 |
✓ corregido en la última versión
|
|
CVE-2024-3647
|
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor] < 4.10.29 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,4
|
< 4.10.29
|
4.10.29 |
2024-04-24 |
✓ corregido en la última versión
|
|
CVE-2024-3885
|
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor] < 4.10.29 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
5,4
|
< 4.10.29
|
4.10.29 |
2024-04-23 |
✓ corregido en la última versión
|
|
CVE-2024-32791
|
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor] < 4.10.26 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,5
|
< 4.10.26
|
4.10.26 |
2024-04-22 |
✓ corregido en la última versión
|
|
CVE-2024-0376
|
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor] < 4.10.17 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
5,4
|
< 4.10.17
|
4.10.17 |
2024-04-09 |
✓ corregido en la última versión
|
|
CVE-2024-2664
|
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor] < 4.10.25 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,4
|
< 4.10.25
|
4.10.25 |
2024-04-09 |
✓ corregido en la última versión
|
|
CVE-2024-2665
|
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor] < 4.10.28 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,5
|
< 4.10.28
|
4.10.28 |
2024-04-09 |
✓ corregido en la última versión
|
|
CVE-2024-2666
|
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor] < 4.10.25 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
5,4
|
< 4.10.25
|
4.10.25 |
2024-04-09 |
✓ corregido en la última versión
|
|
CVE-2024-31278
|
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor] < 4.10.23 |
Exposición de información sensible a un actor no autorizado |
Media
4,3
|
< 4.10.23
|
4.10.23 |
2024-04-05 |
✓ corregido en la última versión
|
|
CVE-2024-29106
|
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor] < 4.10.17 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,5
|
< 4.10.17
|
4.10.17 |
2024-03-19 |
✓ corregido en la última versión
|
|
CVE-2024-2399
|
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor] < 4.10.24 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
5,4
|
< 4.10.24
|
4.10.24 |
2024-03-14 |
✓ corregido en la última versión
|
|
CVE-2024-1680
|
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor] < 4.10.22 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
5,4
|
< 4.10.22
|
4.10.22 |
2024-02-28 |
✓ corregido en la última versión
|
|
CVE-2024-0326
|
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor] < 4.10.19 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,4
|
< 4.10.19
|
4.10.19 |
2024-02-14 |
✓ corregido en la última versión
|
|
CVE-2024-1242
|
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor] < 4.10.19 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,4
|
< 4.10.19
|
4.10.19 |
2024-02-14 |
✓ corregido en la última versión
|
|
CVE-2024-24831
|
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor] < 4.10.17 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,5
|
< 4.10.17
|
4.10.17 |
2024-02-02 |
✓ corregido en la última versión
|
|
—
|
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor] < 4.5.2 |
— |
Desconocido
|
< 4.5.2
|
4.5.2 |
2021-08-30 |
✓ corregido en la última versión
|
|
—
|
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor] < 4.5.2 |
— |
Desconocido
|
< 4.5.2
|
4.5.2 |
2021-08-30 |
✓ corregido en la última versión
|
|
CVE-2021-24257
|
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor] < 4.2.8 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
5,4
|
< 4.2.8
|
4.2.8 |
2021-04-13 |
✓ corregido en la última versión
|
|
—
|
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor] < 4.2.8 |
— |
Desconocido
|
< 4.2.8
|
4.2.8 |
2021-04-13 |
✓ corregido en la última versión
|
|
CVE-2025-4774
|
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor] < 4.11.9 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
5,4
|
< 4.11.9
|
4.11.9 |
0000-00-00 |
✓ corregido en la última versión
|
|
—
|
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor] < 4.5.2 |
— |
Desconocido
|
< 4.5.2
|
4.5.2 |
— |
✓ corregido en la última versión
|
CVE-2024-10266
The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video Box widget in all versions up to, and including, 4.10.60 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2021-4445
The Premium Addons for Elementor plugin for WordPress is vulnerable to Arbitrary Option Updates in versions up to, and including, 4.5.1. This is due to missing capability and nonce checks in the pa_dismiss_admin_notice AJAX action. This makes it possible for authenticated subscriber+ attackers to change arbitrary options with a restricted value of 1 on vulnerable WordPress sites.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2024-8681
The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Media Grid widget in all versions up to, and including, 4.10.52 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2024-6824
The Premium Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'check_temp_validity' and 'update_template_title' functions in all versions up to, and including, 4.10.38. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary content and update post and page titles.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2024-6495
The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Animated Text widget in all versions up to, and including, 4.10.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2024-37922
The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.10.34 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2024-6434
The Premium Addons for Elementor plugin for WordPress is vulnerable to Regular Expression Denial of Service (ReDoS) in all versions up to, and including, 4.10.35. This is due to processing user-supplied input as a regular expression. This makes it possible for authenticated attackers, with Author-level access and above, to create and query a malicious post title, resulting in slowing server resources.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2024-6340
The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 4.10.35 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2024-5553
The Premium Addons for Elementor plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via several parameters in all versions up to, and including, 4.10.33 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses and edits an injected element, and subsequently clicks the element with the mouse scroll wheel.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2024-4376
The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Fancy Text widget in all versions up to, and including, 4.10.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. While 4.10.32 is patched, it is recommended to update to 4.10.33 because 4.10.32 caused a fatal error.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2024-4205
The Premium Addons for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_template_content() function in all versions up to, and including, 4.10.31. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve Elementor template data.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2024-4379
The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Global Tooltip widget in all versions up to, and including, 4.10.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2024-4378
The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's menu and shape widgets in all versions up to, and including, 4.10.30 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2024-4203
The Premium Addons Pro for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the maps widget in all versions up to, and including, 4.10.30 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Please note this only affects sites running the premium version of the plugin.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2024-3647
The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's post ticker widget in all versions up to, and including, 4.10.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the premium version of the plugin to be installed and activated in order to be exploited.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2024-3885
The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the subcontainer value parameter in all versions up to, and including, 4.10.28 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2024-32791
The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.10.25 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2024-0376
Update the WordPress Premium Addons for Elementor plugin to the latest available version (at least 4.10.17).
Webbernaut discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Premium Addons for Elementor Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 4.10.17.
Have additional information or questions about this entry? Get in touch.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2024-2664
Update the WordPress Premium Addons for Elementor plugin to the latest available version (at least 4.10.25).
Webbernaut discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Premium Addons for Elementor Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 4.10.25.
Have additional information or questions about this entry? Get in touch.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2024-2665
Update the WordPress Premium Addons for Elementor plugin to the latest available version (at least 4.10.28).
Dau Hoang Tai discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Premium Addons for Elementor Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 4.10.28.
Have additional information or questions about this entry? Get in touch.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2024-2666
Update the WordPress Premium Addons for Elementor plugin to the latest available version (at least 4.10.25).
wesley (wcraft) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Premium Addons for Elementor Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 4.10.25.
Have additional information or questions about this entry? Get in touch.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2024-31278
Update the WordPress Premium Addons for Elementor plugin to the latest available version (at least 4.10.23).
Khalid discovered and reported this Sensitive Data Exposure vulnerability in WordPress Premium Addons for Elementor Plugin. This vulnerability has been fixed in version 4.10.23.
This vulnerability was reported to and published by Patchstack. Our users receive alerts and protections up to 48 hours in advance.
Have additional information or questions about this entry? Get in touch.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2024-29106
Update the WordPress Premium Addons for Elementor plugin to the latest available version (at least 4.10.17).
Abu Hurayra discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Premium Addons for Elementor Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 4.10.17.
This vulnerability was reported to and published by Patchstack. Our users receive alerts and protections up to 48 hours in advance.
Have additional information or questions about this entry? Get in touch.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2024-2399
Update the WordPress Premium Addons for Elementor plugin to the latest available version (at least 4.10.24).
wesley (wcraft) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Premium Addons for Elementor Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 4.10.24.
Have additional information or questions about this entry? Get in touch.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2024-1680
Update the WordPress Premium Addons for Elementor plugin to the latest available version (at least 4.10.22).
Webbernaut discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Premium Addons for Elementor Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 4.10.22.
Have additional information or questions about this entry? Get in touch.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2024-0326
Update the WordPress Premium Addons for Elementor plugin to the latest available version (at least 4.10.19).
Webbernaut discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Premium Addons for Elementor Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 4.10.19.
Have additional information or questions about this entry? Get in touch.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2024-1242
Update the WordPress Premium Addons for Elementor plugin to the latest available version (at least 4.10.19).
Nikolas discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Premium Addons for Elementor Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 4.10.19.
Have additional information or questions about this entry? Get in touch.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2024-24831
Update the WordPress Premium Addons for Elementor plugin to the latest available version (at least 4.10.17).
Abu Hurayra discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Premium Addons for Elementor Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 4.10.17.
This vulnerability was reported to and published by Patchstack. Our users receive alerts and protections up to 48 hours in advance.
Have additional information or questions about this entry? Get in touch.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor] < 4.5.2
Arbitrary Blog Option Update vulnerability discovered by WPScanTeam in WordPress Premium Addons for Elementor plugin (versions <= 4.5.1).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor] < 4.5.2
The Premium Addons for Elementor plugin for WordPress is vulnerable to Arbitrary Option Updates in versions up to, and including, 4.5.1. This is due to missing capability and nonce checks in the pa_dismiss_admin_notice AJAX action. This makes it possible for authenticated subscriber+ attackers to change arbitrary options with a restricted value of 1 on vulnerable WordPress sites.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2021-24257
The “Premium Addons for Elementor” WordPress Plugin before 4.2.8 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
The “Testimonials” widget accepts a “premium_testimonial_person_name_size” parameter. Although the element control lists a fixed set of possible html tags and this parameter is processed by wp_kses, it is possible to send a ‘save_builder’ request with the “premium_testimonial_person_name_size” set to an externally sourced JavaScript, e.g. “script+src=\"https://ramgall.com/alertscript.js\"”
This JavaScript is not filtered out by wp_kses and will then be executed when the saved page is viewed or previewed. The “premium_testimonial_company_name_size” parameter appears to be vulnerable to the same exploit.
We’ve verified that the Premium Blog widget is similarly vulnerable via the "premium_blog_title_tag" parameter, and the following widgets are likely also vulnerable to similar exploits:
Premium Banner: “premium_banner_title_tag” parameter
Premium Dual Header:”premium_dual_header_first_header_tag” parameter
Premium Persion: “premium_person_name_heading” and “premium_person_title_heading”
Premium Pricing Table: “premium_pricing_table_title_size”
Premium Title: “premium_title_tag”
These vulnerabilities are nearly identical to the vulnerabilities we have recently disclosed in the main Elementor plugin: https://www.wordfence.com/blog/2021/03/cross-site-scripting-vulnerabilities-in-elementor-impact-over-7-million-sites/
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor] < 4.2.8
Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered by WordFence in WordPress Premium Addons for Elementor plugin (versions <= 4.2.7).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2025-4774
The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-countdown attribute of Countdown widget in all versions up to, and including, 4.11.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor] < 4.5.2
The plugin does not have any CSRF and authorisation checks in the pa_dismiss_admin_notice AJAX action, available to any authenticated users, and do not validate the option key to ensure the option to update belongs to the plugin. As a result, any authenticated user, such as subscriber can update arbitrary WordPress options and set them to the value '1'. An attacker changing the users_can_register would enable users registration, other options could be changed to make the blog unusable as well.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
Mantén Premium Addons For Elementor actualizado — 4.11.86 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").
Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.