Skip to main content

Unlimited Elements For Elementor CVE-2023-31090

CRITICAL
Unrestricted Upload of File with Dangerous Type (CWE-434)
2024-04-24 audit@patchstack.com
File Upload Unlimited Elements For Elementor Elementor Unlimited Elements
9.9
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.9 CRITICAL
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Apr 24, 2024 - 16:15 cve.org
CRITICAL 9.9

DescriptionCVE.org

Unrestricted Upload of File with Dangerous Type vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Upload a Web Shell to a Web Server.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 1.5.60.

AnalysisAI

Unrestricted Upload of File with Dangerous Type vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Upload a Web Shell to a Web Server.5.60. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Unrestricted File Upload (CWE-434), which allows attackers to upload malicious files that can be executed on the server. Unrestricted Upload of File with Dangerous Type vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Upload a Web Shell to a Web Server.5.60. Affected products include: Unlimited-Elements Unlimited Elements For Elementor. Version information: through 1.5.60..

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate file types server-side, store uploads outside webroot, use random filenames, scan for malware.

More in Unlimited Elements For Elementor

View all
CVE-2026-10081 HIGH POC
8.8 Jul 20

Stored cross-site scripting in the Unlimited Elements For Elementor WordPress plugin (all versions before 2.0.11) lets a
CVE-2024-29792 HIGH POC
7.1 Mar 27

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements
CVE-2023-6743 HIGH
8.8 May 29

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Remote Code
CVE-2023-31231 CRITICAL
9.9 Dec 20

Unrestricted Upload of File with Dangerous Type vulnerability in Unlimited Elements Unlimited Elements For Elementor (Fr
CVE-2024-49271 CRITICAL
9.1 Oct 16

Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Ad
CVE-2024-5329 HIGH
8.8 Jun 06

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to blind SQL I
CVE-2024-4779 HIGH
8.8 May 23

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to SQL Injecti
CVE-2024-3055 HIGH
8.8 May 14

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to time-based

CVE-2023-3295 HIGH
8.8 Jun 17

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) for WordPress is vulnerable to arbitrary file upl
CVE-2026-48837 HIGH
8.5 May 25

Blind SQL injection in the Unlimited Elements For Elementor WordPress plugin (versions up to and including 2.0.8) allows
CVE-2024-2662 HIGH
7.2 May 14

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to command inj
CVE-2026-18561 HIGH
7.5 Sep 11

Unauthenticated SQL injection in the Unlimited Elements For Elementor WordPress plugin (versions ≤2.0.16) allows remote

Same weakness CWE-434 – Unrestricted Upload of File with Dangerous Type

View all
CVE-2016-3088 CRITICAL POC
9.8
CVE-2021-31207 MEDIUM POC
6.6
CVE-2017-12617 HIGH POC
8.1
CVE-2024-50623 CRITICAL POC
9.8
CVE-2017-11357 CRITICAL POC
9.8
CVE-2017-12615 HIGH POC
8.1
CVE-2018-9206 CRITICAL POC
9.8
CVE-2024-5084 CRITICAL POC
9.8

Same technique File Upload

View all
CVE-2016-3088 CRITICAL POC
9.8
CVE-2017-12617 HIGH POC
8.1
CVE-2020-1938 CRITICAL POC
9.8
CVE-2024-50623 CRITICAL POC
9.8
CVE-2017-11357 CRITICAL POC
9.8
CVE-2017-12615 HIGH POC
8.1
CVE-2018-9206 CRITICAL POC
9.8
CVE-2024-5084 CRITICAL POC
9.8

Share

CVE-2023-31090 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy