CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-34384 – WordPress Sina Extension for Elementor plugin <= 3.5.1 - Local File Inclusion vulnerability
https://notcve.org/view.php?id=CVE-2024-34384
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SinaExtra Sina Extension for Elementor allows PHP Local File Inclusion.This issue affects Sina Extension for Elementor: from n/a through 3.5.1. Limitación inadecuada de una vulnerabilidad de nombre de ruta a un directorio restringido ("Path Traversal") en SinaExtra Sina Extension para Elementor permite la inclusión de archivos locales PHP. Este problema afecta a Sina Extension para Elementor: desde n/a hasta 3.5.1. The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.5.1. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. • https://patchstack.com/database/vulnerability/sina-extension-for-elementor/wordpress-sina-extension-for-elementor-plugin-3-5-1-local-file-inclusion-vulnerability?_s_id=cve • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-29935 – WordPress Sina Extension for Elementor plugin <= 3.5.0 - Cross Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2024-29935
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SinaExtra Sina Extension for Elementor allows Stored XSS.This issue affects Sina Extension for Elementor: from n/a through 3.5.0. Neutralización inadecuada de la entrada durante la vulnerabilidad de generación de páginas web ('Cross-site Scripting') en SinaExtra Sina Extension para Elementor permite almacenar XSS. Este problema afecta a Sina Extension para Elementor: desde n/a hasta 3.5.0. The Sina Extension for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://patchstack.com/database/vulnerability/sina-extension-for-elementor/wordpress-sina-extension-for-elementor-plugin-3-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-24269 – Sina Extension for Elementor < 3.3.12 - Contributor+ Stored XSS
https://notcve.org/view.php?id=CVE-2021-24269
The “Sina Extension for Elementor” WordPress Plugin before 3.3.12 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method. El Plugin de WordPress "Sina Extension for Elementor" versiones anteriores a 3.3.12, presenta varios widgets que son vulnerables a un ataque de tipo Cross-Site Scripting (XSS) almacenado por usuarios con menos privilegios, como los contribuyentes, todo por medio de un método similar • https://wpscan.com/vulnerability/df953a91-f1d8-42e9-8966-f2012d4f97c9 https://www.wordfence.com/blog/2021/04/recent-patches-rock-the-elementor-ecosystem • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-15839 – Sina Extension for Elementor < 2.2.1 - Local File Inclusion
https://notcve.org/view.php?id=CVE-2019-15839
The sina-extension-for-elementor plugin before 2.2.1 for WordPress has local file inclusion. El plugin sina-extension-for-elementor anterior a la versión 2.2.1 para WordPress tiene inclusión de archivos locales. • https://wordpress.org/plugins/sina-extension-for-elementor/#developers https://wpvulndb.com/vulnerabilities/9368 https://www.pluginvulnerabilities.com/2019/06/18/our-proactive-monitoring-caught-a-local-file-inclusion-lfi-vulnerability-being-added-in-to-sina-extension-for-elementor • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') CWE-829: Inclusion of Functionality from Untrusted Control Sphere •