The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.89 via the template import functionality. This makes it possible for authenticated attackers, with contributor access and above, to execute code on the server.
CVSS
No CVSS.
References
Configurations
Configuration 1 (hide)
|
History
30 Jan 2025, 16:09
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-94 | |
| References | () https://plugins.trac.wordpress.org/changeset/3010986/unlimited-elements-for-elementor#file6 - Patch | |
| References | () https://plugins.trac.wordpress.org/changeset/3015166/unlimited-elements-for-elementor - Patch | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/25f71a19-85b1-4bc9-b193-d9de2eba81ee?source=cve - Third Party Advisory | |
| References | () https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/provider/core/plugins/unlimited_elements/elementor/elementor_widget.class.php#L3948 - Product | |
| References | () https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_output.class.php#L1765 - Product | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : unknown |
| First Time |
Unlimited-elements unlimited Elements For Elementor
Unlimited-elements |
|
| CPE | cpe:2.3:a:unlimited-elements:unlimited_elements_for_elementor:*:*:*:*:*:wordpress:*:* |
29 May 2024, 05:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-05-29 05:16
Updated : 2025-01-30 16:09
NVD link : CVE-2023-6743
Mitre link : CVE-2023-6743
JSON object : View
Products Affected
unlimited-elements
- unlimited_elements_for_elementor
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')