Ultimate Bootstrap Elements For Elementor Vulnerabilities

[en] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in g5theme Ultimate Bootstrap Elements for Elementor allows PHP Local File Inclusion. This issue affects Ultimate Bootstrap Elements for Elementor: from n/a through 1.4.9.

Affected:

up to 1.5.0

Fixed in:

1.5.0

Disclosed:

Apr 11, 2025

CVE-2025-32672 on NVD →

The Ultimate Bootstrap Elements for Elementor plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.4.9. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be...

CVSS:

9.8

Affected:

up to 1.4.9

Fixed in:

1.5.0

Disclosed:

Apr 9, 2025

CVE-2025-32672 on NVD →

[en] The Ultimate Bootstrap Elements for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6 via the 'ube_get_page_templates' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive...

Affected:

up to 1.4.7

Fixed in:

1.4.7

Disclosed:

Nov 5, 2024

CVE-2024-10329 on NVD →

The Ultimate Bootstrap Elements for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6 via the 'ube_get_page_templates' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data...

CVSS:

4.3

Affected:

up to 1.4.6

Fixed in:

1.4.7

Disclosed:

Nov 4, 2024

CVE-2024-10329 on NVD →

[en] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in G5Theme Ultimate Bootstrap Elements for Elementor allows PHP Local File Inclusion.This issue affects Ultimate Bootstrap Elements for Elementor: from n/a through 1.4.4.

Affected:

up to 1.4.5

Fixed in:

1.4.5

Disclosed:

Aug 13, 2024

CVE-2024-43140 on NVD →

The Ultimate Bootstrap Elements for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.4 via the style/layout attribute of various blocks. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbit...

CVSS:

8.8

Affected:

up to 1.4.4

Fixed in:

1.4.5

Disclosed:

Aug 7, 2024

CVE-2024-43140 on NVD →

[en] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in G5Theme Ultimate Bootstrap Elements for Elementor allows Path Traversal.This issue affects Ultimate Bootstrap Elements for Elementor: from n/a through 1.4.2.

Affected:

up to 1.4.3

Fixed in:

1.4.3

Disclosed:

Jul 9, 2024

CVE-2024-37462 on NVD →

The Ultimate Bootstrap Elements for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.2. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution...

CVSS:

8.8

Affected:

up to 1.4.2

Fixed in:

1.4.3

Disclosed:

Jul 1, 2024

CVE-2024-37462 on NVD →

[en] The Ultimate Bootstrap Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Widget in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...

Affected:

up to 1.4.1

Fixed in:

1.4.1

Disclosed:

Apr 6, 2024

CVE-2024-2132 on NVD →

The Ultimate Bootstrap Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Widget in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVSS:

6.4

Affected:

up to 1.4.0

Fixed in:

1.4.1

Disclosed:

Apr 5, 2024

CVE-2024-2132 on NVD →

[en] The Ultimate Bootstrap Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘heading_title_tag’ and ’heading_sub_title_tag’ parameters in all versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authe...

Affected:

up to 1.3.7

Fixed in:

1.3.7

Disclosed:

Mar 2, 2024

CVE-2024-1398 on NVD →

The Ultimate Bootstrap Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘heading_title_tag’ and ’heading_sub_title_tag’ parameters in all versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authentica...

CVSS:

6.4

Affected:

up to 1.3.6

Fixed in:

1.3.7

Disclosed:

Mar 1, 2024

CVE-2024-1398 on NVD →