Vulnerability · Published Jun 14, 2021 · Assigned by WPScan
CVE-2021-24358The Plus Addons for Elementor Page Builder < 4.1.10 - Open Redirect
Medium 6.1
In plain English
A medium-severity open redirect in The Plus Addons for Elementor Page Builder from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 83% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS NVD)6.1Medium
Exploit odds (30 days)2.3%top 16.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Nuclei
Official description
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.10 did not validate a redirect parameter on a specifically crafted URL before redirecting the user to it, leading to an Open Redirect issue.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | The Plus Addons for Elementor Page Builder | 4.1.10 – before 4.1.10 |
Weakness: CWE-601
References
- https://theplusaddons.com/changelog/ x_refsource_MISC
- https://wpscan.com/vulnerability/fd4352ad-dae0-4404-94d1-11083cb1f44d x_refsource_CONFIRM