CVE-2023-33922

The Elementor plugin in versions through 3.13.3 contains a flaw in the template "save_item" function that fails to properly validate user input, allowing attackers with contributor-level access or higher to generate templates assigned to arbitrary post types. This vulnerability could be leveraged to exploit other installed plugins that rely on custom post types, since attackers can craft templates that interfere with those plugins' functionality. The issue stems from insufficient restrictions on which post types can be assigned during template creation.

Based on public CVE data (MITRE/NVD).