CVE-2022-4953

Elementor < 3.5.5 - Iframe Injection

State: Published
Severity: Not scored
Published: Aug 14, 2023
Updated: Aug 3, 2024
Reserved: Jul 19, 2023

Description

The Elementor Website Builder WordPress plugin before 3.5.5 does not filter out user-controlled URLs from being loaded into the DOM. This could be used to inject rogue iframes that point to malicious URLs.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
Elementor Website BuilderUnknown	before 3.5.5Affected

References

https://wpscan.com/vulnerability/8273357e-f9e1-44bc-8082-8faab838eda7exploitvdb-entrytechnical-description
https://github.com/elementor/elementor/commit/292fc49e0f979bd52d838f0326d1faaebfa59f5e

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.