Anywhere Elementor Vulnerabilities

The AnyWhere Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.11 via the 'INSERT_ELEMENTOR' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above...

CVSS:

4.3

Affected:

up to 1.2.11

Fixed in:

1.2.12

Disclosed:

Dec 4, 2024

CVE-2024-10777 on NVD →

The AnyWhere Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.7 via the wpv_ae. This allowed anyone able to view the plugin repo to view a Freemius API Secret Key allowing them to purchase Freemius Pro using fake credit card numbers. The API Key has be...

CVSS:

8.6

Affected:

up to 1.2.7

Fixed in:

1.2.8

Disclosed:

May 2, 2023

CVE-2023-0443 on NVD →

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. An...

CVSS:

6.3

Affected:

up to 1.2.5

Fixed in:

1.2.5

Disclosed:

Mar 4, 2022

CVE-2022-4974 on NVD →