plugin

Envato Elements Vulnerabilities

2 known security issues reported for the Envato Elements WordPress plugin. Most recent disclosed Jan 3, 2025.

1 high 1 medium

Running Envato Elements on your site? Check whether your installed version is affected.

Scan your site free

Envato Elements <= 2.0.14 - Authenticated (Author+) Server-Side Request Forgery

medium

The Envato Elements – Photos & Elementor Templates plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.0.14. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web...

CVSS:
6.4
Affected:
up to 2.0.14
Fixed in:
2.0.15
Disclosed:
Jan 3, 2025

CVE-2024-56275 on NVD →

Envato Elements <= 2.0.10 & Template Kit <= 1.0.13 - Authenticated (Contributor+) Arbitrary File Upload

high

The Envato Elements & Download and Template Kit – Import plugins for WordPress are vulnerable to arbitrary file uploads due to insufficient validation of file type upon extracting uploaded Zip files in the installFreeTemplateKit and uploadTemplateKitZipFile functions. This makes it possible for attackers with contribut...

CVSS:
8.8
Affected:
up to 2.0.10
Fixed in:
2.0.11
Disclosed:
Oct 21, 2021

CVE-2021-4330 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database