4.3
Moyenne
CVE-2024-10777 The AnyWhere Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and…
Description
The AnyWhere Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.11 via the 'INSERT_ELEMENTOR' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| AnyWhere Elementor 1.2 | premières → 1.2.11 | Pas de correctif indiqué |
| Dynific Addons for Elementor (formerly AnyWhere Elementor) 1.2 | premières → 1.2.11 | Pas de correctif indiqué |
Autres CVE de AnyWhere Elementor
Les 5 CVE de AnyWhere Elementor →
CVE-2026-114187
WordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerability
5.3
Moyenne
CVE-2026-114185
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes AnyWhere…
6.5
Moyenne
CVE-2026-114183
Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes AnyWhere Elementor anywhere-elementor…
6.5
Moyenne
CVE-2022-4974
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request…
6.3
Moyenne