CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
What the vulnerability does
The Elementor Header & Footer Builder for WordPress is vulnerable to HTML Injection in all versions up to, and including, 1.6.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level permissions and above, to inject arbitrary HTML in pages that will be shown whenever a user accesses an injected page.
Explanation of Vulnerability in Simple Terms
Ultimate Addons for Elementor versions up to 1.6.26 lack proper authorization checks on certain functions. A logged-in user with low privileges can modify content or settings they should not have access to. The vulnerability affects the integrity of site data but not confidentiality or availability. Update to a version newer than 1.6.26.
What an attacker can do
Modify site content or settings without proper authorization.
Potential impact on your site
Unauthorized users can alter site content, pages, or plugin settings they shouldn't access.
Conditions required to exploit
Attacker must be logged in with low-level user privileges.
Key dates
External resources
Related vulnerabilities
