Themewant
Monthly
Unauthenticated privilege escalation in the Easy Elements for Elementor WordPress plugin through version 1.4.5 allows remote attackers to register administrator accounts by abusing an unchecked custom_meta parameter in the eel_register AJAX handler. The flaw lets attackers overwrite the wp_capabilities user meta after wp_insert_user() has assigned a safe role, granting full site takeover. No public exploit identified at time of analysis, and the CVSS vector's PR:L appears inconsistent with the description's explicit unauthenticated abuse path.
Privilege escalation in the Easy Elements for Elementor WordPress plugin (versions up to and including 1.4.4) allows unauthenticated remote attackers to register accounts with the 'administrator' role, granting full site takeover. The flaw exists in the 'easyel_handle_register' function which fails to validate or restrict the user role parameter submitted during registration. No public exploit identified at time of analysis, but the trivial nature of the bug and Wordfence's disclosure make weaponization straightforward.
Stored cross-site scripting in the WordPress plugin RT Mega Menu - Mega Menu Builder for Elementor & Gutenberg (all versions through 1.5.1) allows an attacker with an authenticated Subscriber-level account or higher to inject arbitrary JavaScript through the 'css[left]' mega-menu styling parameter, which is persisted and then executed in the browser of every visitor who loads a page rendering the poisoned menu. The assessed severity is moderate (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), with the low privilege bar rather than the payload itself being the main limiting factor; no public exploit code and no confirmed active exploitation were identified at time of analysis, so priority should be driven by whether the site allows self-registration or hosts untrusted low-privileged users.
Stored cross-site scripting in the WordPress plugin RT Mega Menu - Mega Menu Builder for Elementor & Gutenberg (all versions up to and including 1.5.2) allows authenticated attackers holding contributor-level or higher privileges to plant a tag-less script payload in a block's 'pointer_menu_item' attribute, which then executes in the browser of any administrator, editor, or visitor who opens the injected page. Because the payload contains no HTML tags it slips past the wp_kses_post filtering applied on save and survives intact inside the block comment's JSON attributes, so the plugin's navigation walker renders it unescaped. Vendor CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N); no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV); the contributor-level authentication gate limits real-world exposure to sites that grant untrusted users authoring accounts.
Broken access control in RT Mega Menu plugin for WordPress ≤1.5.1 allows authenticated subscribers to modify mega menu settings without proper authorization checks. This could lead to unauthorized changes to navigation structures, potentially facilitating phishing or content tampering. No public exploit or active exploitation reported at time of analysis.
Cross-site scripting in RT Mega Menu <=1.5.1 allows authenticated attackers with subscriber-level access to inject malicious JavaScript into menu items. The injected script executes in the context of any user visiting a page with the corrupted mega menu, enabling session token theft, site defacement, or redirection. No active exploitation or public exploit code is currently confirmed.
Unauthenticated privilege escalation in the Easy Elements for Elementor WordPress plugin through version 1.4.5 allows remote attackers to register administrator accounts by abusing an unchecked custom_meta parameter in the eel_register AJAX handler. The flaw lets attackers overwrite the wp_capabilities user meta after wp_insert_user() has assigned a safe role, granting full site takeover. No public exploit identified at time of analysis, and the CVSS vector's PR:L appears inconsistent with the description's explicit unauthenticated abuse path.
Privilege escalation in the Easy Elements for Elementor WordPress plugin (versions up to and including 1.4.4) allows unauthenticated remote attackers to register accounts with the 'administrator' role, granting full site takeover. The flaw exists in the 'easyel_handle_register' function which fails to validate or restrict the user role parameter submitted during registration. No public exploit identified at time of analysis, but the trivial nature of the bug and Wordfence's disclosure make weaponization straightforward.
Stored cross-site scripting in the WordPress plugin RT Mega Menu - Mega Menu Builder for Elementor & Gutenberg (all versions through 1.5.1) allows an attacker with an authenticated Subscriber-level account or higher to inject arbitrary JavaScript through the 'css[left]' mega-menu styling parameter, which is persisted and then executed in the browser of every visitor who loads a page rendering the poisoned menu. The assessed severity is moderate (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), with the low privilege bar rather than the payload itself being the main limiting factor; no public exploit code and no confirmed active exploitation were identified at time of analysis, so priority should be driven by whether the site allows self-registration or hosts untrusted low-privileged users.
Stored cross-site scripting in the WordPress plugin RT Mega Menu - Mega Menu Builder for Elementor & Gutenberg (all versions up to and including 1.5.2) allows authenticated attackers holding contributor-level or higher privileges to plant a tag-less script payload in a block's 'pointer_menu_item' attribute, which then executes in the browser of any administrator, editor, or visitor who opens the injected page. Because the payload contains no HTML tags it slips past the wp_kses_post filtering applied on save and survives intact inside the block comment's JSON attributes, so the plugin's navigation walker renders it unescaped. Vendor CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N); no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV); the contributor-level authentication gate limits real-world exposure to sites that grant untrusted users authoring accounts.
Broken access control in RT Mega Menu plugin for WordPress ≤1.5.1 allows authenticated subscribers to modify mega menu settings without proper authorization checks. This could lead to unauthorized changes to navigation structures, potentially facilitating phishing or content tampering. No public exploit or active exploitation reported at time of analysis.
Cross-site scripting in RT Mega Menu <=1.5.1 allows authenticated attackers with subscriber-level access to inject malicious JavaScript into menu items. The injected script executes in the context of any user visiting a page with the corrupted mega menu, enabling session token theft, site defacement, or redirection. No active exploitation or public exploit code is currently confirmed.