Clever Addons for Elementor <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
medium
The Clever Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scrip...
- CVSS:
- 6.4
- Affected:
- up to 2.2.1
- Fix:
- No patched version reported
- Disclosed:
- Oct 31, 2024
CVE-2024-51580 on NVD →
Clever Addons for Elementor <= 2.2.1 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates
medium
The Clever Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.1 via the getTemplateContent function in src/widgets/class-clever-widget-base.php. This makes it possible for authenticated attackers, with Contributor-level access and above, t...
- CVSS:
- 4.3
- Affected:
- up to 2.2.1
- Fix:
- No patched version reported
- Disclosed:
- Oct 25, 2024
CVE-2024-10357 on NVD →
Clever Addons for Elementor <= 2.2.0 - Authenticated (Author+) Stored Cross-Site Scripting
medium
The Clever Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Scroll to widget in versions up to, and including, 2.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject...
- CVSS:
- 6.4
- Affected:
- up to 2.2.0
- Fixed in:
- 2.2.1
- Disclosed:
- Aug 16, 2024
CVE-2024-43324 on NVD →
Clever Addons for Elementor <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple CAFE Widgets
medium
The Clever Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the CAFE Icon, CAFE Team Member, and CAFE Slider widgets in all versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
- CVSS:
- 6.4
- Affected:
- up to 2.1.9
- Fixed in:
- 2.2.0
- Disclosed:
- Jun 5, 2024
CVE-2024-2350 on NVD →
Clever Addons for Elementor <=2.0.15 - Stored Cross-Site Scripting
medium
The “Clever Addons for Elementor” WordPress Plugin before 2.1.0 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
- CVSS:
- 6.4
- Affected:
- up to 2.1.0
- Fixed in:
- 2.1.0
- Disclosed:
- Apr 15, 2021
CVE-2021-24273 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database