Vulnerability · Published May 10, 2024 · Assigned by Wordfence

CVE-2024-2662Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.102 - Authenticated (Admin+) Command Injection

High 7.2

In plain English

A high-severity OS command injection in Unlimited Elements For Elementor from unitecms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 78% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)1.7%top 22.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to command injection in all versions up to, and including, 1.5.102. This is due to insufficient filtering of template attributes during the creation of HTML for custom widgets This makes it possible for authenticated attackers, with administrator-level access and above, to execute arbitrary commands on the server.

Affected products (as reported)

Vendor	Product	Versions
unitecms	Unlimited Elements For Elementor	0 – through 1.5.102

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

In plain English

Official description

Affected products (as reported)

References