CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-0086 – JetWidgets for Elementor <= 1.0.12 - Cross-Site Request Forgery to Settings Update
https://notcve.org/view.php?id=CVE-2023-0086
The JetWidgets for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.12. This is due to missing nonce validation on the save() function. This makes it possible for unauthenticated attackers to to modify the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can be used to enable SVG uploads that could make Cross-Site Scripting possible. • https://plugins.trac.wordpress.org/browser/jetwidgets-for-elementor/trunk/includes/class-jet-widgets-settings.php#L149 https://www.wordfence.com/threat-intel/vulnerabilities/id/8de3d3c7-bde2-4455-8d60-20307f0a53ee • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-24268 – JetWidgets For Elementor < 1.0.9 - Contributor+ Stored XSS
https://notcve.org/view.php?id=CVE-2021-24268
The “JetWidgets For Elementor” WordPress Plugin before 1.0.9 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method. El Plugin "JetWidgets For Elementor" WordPress versiones anteriores a 1.0.9, presenta varios widgets que son vulnerables a un ataque de tipo Cross-Site Scripting (XSS) almacenado por usuarios con menos privilegios, como los contribuyentes, todo por medio de un método similar • https://wpscan.com/vulnerability/68ecb965-2a9d-4e67-b069-c3dbfb14016b https://www.wordfence.com/blog/2021/04/recent-patches-rock-the-elementor-ecosystem • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •