CVE-2023-0280

CVE-2023-0280: Ultimate Carousel For Elementor <= 2.1.7 - Contributor+ Stored XSS

Vendor Unknown
Product Ultimate Carousel For Elementor
Published May 8, 2023
Last update February 4, 2025

CVSS base score

—

What the vulnerability does

01Description

The Ultimate Carousel For Elementor WordPress plugin through 2.1.7 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Key dates

02Disclosure timeline

May 8, 2023 CVE published
February 4, 2025 Record updated