Pdf Viewer For Elementor Vulnerabilities

[en] The PDF Viewer for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the render function in all versions up to, and including, 2.9.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above,...

Affected:

up to 2.9.3

Fix:

No patched version reported

Disclosed:

Jun 18, 2024

CVE-2024-0845 on NVD →

The PDF Viewer for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the render function in all versions up to, and including, 2.9.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to i...

CVSS:

6.4

Affected:

up to 2.9.3

Fix:

No patched version reported

Disclosed:

Jun 17, 2024

CVE-2024-0845 on NVD →

PDF.js is vulnerable to Arbitrary JavaScript Execution in versions prior to 4.2.67. This is due to a missing type check when handling fonts. This makes it possible for authenticated attackers, with contributor-level or above permissions, to execute arbitrary JavaScript if they can successfully trick a user into opening...

CVSS:

6.4

Affected:

up to 2.9.3

Fix:

No patched version reported

Disclosed:

May 20, 2024

CVE-2024-4367 on NVD →

[en] A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.

Affected:

up to 2.9.3

Fix:

No patched version reported

Disclosed:

May 14, 2024

CVE-2024-4367 on NVD →

[en] A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.

Affected:

up to 2.9.3

Fix:

No patched version reported

Disclosed:

May 14, 2024

CVE-2024-4367 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RedLettuce Plugins PDF Viewer for Elementor allows Stored XSS.This issue affects PDF Viewer for Elementor: from n/a through 2.9.3.

Affected:

up to 2.9.3

Fix:

No patched version reported

Disclosed:

Mar 31, 2024

CVE-2024-30524 on NVD →

The PDF Viewer for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.9.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts...

CVSS:

6.4

Affected:

up to 2.9.3

Fix:

No patched version reported

Disclosed:

Mar 29, 2024

CVE-2024-30524 on NVD →