Ultra Addons Lite For Elementor
Monthly
Stored cross-site scripting in the Ultra Addons Lite for Elementor WordPress plugin (all versions up to and including 1.3.2) lets an authenticated attacker with contributor-level access or higher inject arbitrary JavaScript through unsanitized attributes of the plugin's Type Out widget; the script is persisted in the page and executes in the browser of any user who subsequently views it, yielding CVSS 6.4 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The flaw is a CWE-79 input-sanitization and output-escaping failure, scoped to sites that have the plugin active and that grant content-authoring accounts to untrusted users; there is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation currently requires deliberate attacker effort with an existing contributor account. No vendor-released patch or fixed version has been identified at time of analysis, leaving site owners dependent on removing or disabling the Type Out widget or removing the plugin until an update ships.
The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.8 via the 'ut_elementor' shortcode due to insufficient. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Stored cross-site scripting in the Ultra Addons Lite for Elementor WordPress plugin (all versions up to and including 1.3.2) lets an authenticated attacker with contributor-level access or higher inject arbitrary JavaScript through unsanitized attributes of the plugin's Type Out widget; the script is persisted in the page and executes in the browser of any user who subsequently views it, yielding CVSS 6.4 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The flaw is a CWE-79 input-sanitization and output-escaping failure, scoped to sites that have the plugin active and that grant content-authoring accounts to untrusted users; there is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation currently requires deliberate attacker effort with an existing contributor account. No vendor-released patch or fixed version has been identified at time of analysis, leaving site owners dependent on removing or disabling the Type Out widget or removing the plugin until an update ships.
The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.8 via the 'ut_elementor' shortcode due to insufficient. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.