CVE-2024-2210, CVE-2024-2203

The Plus Addons for Elementor plugin contains a local file inclusion vulnerability in the Team Member Listing widget affecting versions up to 5.4.1, which allows authenticated users with contributor privileges or higher to load and run arbitrary files from the server. By exploiting this flaw, attackers can execute PHP code contained within uploaded files, potentially circumventing security restrictions, accessing confidential information, or gaining code execution through seemingly harmless file uploads like images. The vulnerability has been patched in version 5.4.2.

Based on public CVE data (MITRE/NVD).