Elementor Website Builder
Monthly
Information disclosure in Elementor Website Builder (all versions before 4.1.4) allows authenticated WordPress users with Contributor-level access or above to read the title, body, and metadata of private posts, private pages, and drafts belonging to other users - including site administrators - via an improperly permission-checked REST endpoint. A publicly available proof-of-concept exploit exists (reported by WPScan), though EPSS places exploitation probability at 0.14% (4th percentile), indicating limited current in-the-wild activity despite public PoC. No active exploitation has been confirmed by CISA KEV; the vendor has released a patched version (4.1.4).
Sensitive data exposure in Elementor Website Builder for WordPress (versions <= 4.1.3) allows contributor-level authenticated users to access protected information due to missing authorization checks (CWE-862). The vulnerability stems from insufficient capability verification before exposing sensitive data to lower-privileged roles, enabling a contributor to retrieve data they should not have access to. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and high confidentiality impact make this a meaningful risk on any site with untrusted contributor accounts.
Broken access control in Elementor Website Builder through version 3.35.5 permits high-privileged, network-based WordPress users to exceed their intended authorization boundaries by exploiting incorrectly configured access control security levels. The missing authorization checks (CWE-862) allow a scoped integrity modification - no confidentiality or availability impact is indicated. With a CVSS score of 2.7 (Low), EPSS at 0.02% (4th percentile), no CISA KEV listing, and no public exploit identified at time of analysis, this vulnerability presents low urgency in practice despite the widespread deployment footprint of the plugin.
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in Elementor Website Builder through version 3.35.5, allowing authenticated attackers with low privileges to inject malicious scripts that execute in the context of other users' browsers. An attacker can exploit this via a crafted page or element to steal session cookies, redirect users, or perform actions on their behalf. The vulnerability requires user interaction (UI:R) and authenticated access (PR:L), but carries a moderate CVSS score of 6.5 with cross-site impact (S:C), indicating meaningful business risk despite not being unauthenticated.
Information disclosure in Elementor Website Builder (all versions before 4.1.4) allows authenticated WordPress users with Contributor-level access or above to read the title, body, and metadata of private posts, private pages, and drafts belonging to other users - including site administrators - via an improperly permission-checked REST endpoint. A publicly available proof-of-concept exploit exists (reported by WPScan), though EPSS places exploitation probability at 0.14% (4th percentile), indicating limited current in-the-wild activity despite public PoC. No active exploitation has been confirmed by CISA KEV; the vendor has released a patched version (4.1.4).
Sensitive data exposure in Elementor Website Builder for WordPress (versions <= 4.1.3) allows contributor-level authenticated users to access protected information due to missing authorization checks (CWE-862). The vulnerability stems from insufficient capability verification before exposing sensitive data to lower-privileged roles, enabling a contributor to retrieve data they should not have access to. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and high confidentiality impact make this a meaningful risk on any site with untrusted contributor accounts.
Broken access control in Elementor Website Builder through version 3.35.5 permits high-privileged, network-based WordPress users to exceed their intended authorization boundaries by exploiting incorrectly configured access control security levels. The missing authorization checks (CWE-862) allow a scoped integrity modification - no confidentiality or availability impact is indicated. With a CVSS score of 2.7 (Low), EPSS at 0.02% (4th percentile), no CISA KEV listing, and no public exploit identified at time of analysis, this vulnerability presents low urgency in practice despite the widespread deployment footprint of the plugin.
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in Elementor Website Builder through version 3.35.5, allowing authenticated attackers with low privileges to inject malicious scripts that execute in the context of other users' browsers. An attacker can exploit this via a crafted page or element to steal session cookies, redirect users, or perform actions on their behalf. The vulnerability requires user interaction (UI:R) and authenticated access (PR:L), but carries a moderate CVSS score of 6.5 with cross-site impact (S:C), indicating meaningful business risk despite not being unauthenticated.