// For flags

CVE-2022-0683

Essential Addons for Elementor Lite <= 5.0.8 Reflected Cross-Site Scripting

Severity Score

6.1
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The Essential Addons for Elementor Lite WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the settings parameter found in the ~/includes/Traits/Helper.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever a user clicks on a specially crafted link by an attacker. This affects versions up to and including 5.0.8.

El plugin Essential Addons for Elementor Lite de WordPress es vulnerable a Cross-Site Scripting debido a un escape y saneo insuficientes del parámetro settings encontrado en el archivo ~/includes/Traits/Helper.php que permite a atacantes inyectar scripts web arbitrarios en una página que es ejecutado cada vez que un usuario hace clic en un enlace especialmente diseñado por un atacante. Esto afecta a versiones hasta 5.0.8 incluyéndola

*Credits: Pham Van Khanh (rskvp93) from VCSLab of Viettel Cyber Security & Nguyen Dinh Bien (biennd4) from VCSLab of Viettel Cyber Security
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-02-18 CVE Reserved
  • 2022-02-18 CVE Published
  • 2024-08-02 CVE Updated
  • 2024-11-09 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Wpdeveloper
Search vendor "Wpdeveloper"
 Essential Addons For Elementor
Search vendor "Wpdeveloper" for product "Essential Addons For Elementor"
 <= 5.0.8
Search vendor "Wpdeveloper" for product "Essential Addons For Elementor" and version " <= 5.0.8"
wordpress
Affected