Ultimate Addons for Elementor

The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘size’ parameter in all versions up to, and including, 1.6.46 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE number: CVE-2024-11230

This vulnerability affects the following application versions:

• Ultimate Addons for Elementor 1.6.41
• Ultimate Addons for Elementor 1.6.42
• Ultimate Addons for Elementor 1.6.43
• Ultimate Addons for Elementor 1.6.44
• Ultimate Addons for Elementor 1.6.45
• Ultimate Addons for Elementor 1.6.46

The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 1.6.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. CVE-2024-10325

This vulnerability affects the following application versions:

• Ultimate Addons for Elementor 1.6.0
• Ultimate Addons for Elementor 1.6.1
• Ultimate Addons for Elementor 1.6.2
• Ultimate Addons for Elementor 1.6.3
• Ultimate Addons for Elementor 1.6.4
• Ultimate Addons for Elementor 1.6.5
• Ultimate Addons for Elementor 1.6.6
• Ultimate Addons for Elementor 1.6.7
• Ultimate Addons for Elementor 1.6.8
• Ultimate Addons for Elementor 1.6.9
• Ultimate Addons for Elementor 1.6.10
• Ultimate Addons for Elementor 1.6.11
• Ultimate Addons for Elementor 1.6.12
• Ultimate Addons for Elementor 1.6.13
• Ultimate Addons for Elementor 1.6.14
• Ultimate Addons for Elementor 1.6.15
• Ultimate Addons for Elementor 1.6.16
• Ultimate Addons for Elementor 1.6.17
• Ultimate Addons for Elementor 1.6.18
• Ultimate Addons for Elementor 1.6.19
• Ultimate Addons for Elementor 1.6.20
• Ultimate Addons for Elementor 1.6.21
• Ultimate Addons for Elementor 1.6.22
• Ultimate Addons for Elementor 1.6.23
• Ultimate Addons for Elementor 1.6.24
• Ultimate Addons for Elementor 1.6.25
• Ultimate Addons for Elementor 1.6.26
• Ultimate Addons for Elementor 1.6.27
• Ultimate Addons for Elementor 1.6.28
• Ultimate Addons for Elementor 1.6.29
• Ultimate Addons for Elementor 1.6.30
• Ultimate Addons for Elementor 1.6.31
• Ultimate Addons for Elementor 1.6.32
• Ultimate Addons for Elementor 1.6.33
• Ultimate Addons for Elementor 1.6.34
• Ultimate Addons for Elementor 1.6.35
• Ultimate Addons for Elementor 1.6.36
• Ultimate Addons for Elementor 1.6.37
• Ultimate Addons for Elementor 1.6.38
• Ultimate Addons for Elementor 1.6.39
• Ultimate Addons for Elementor 1.6.40
• Ultimate Addons for Elementor 1.6.41
• Ultimate Addons for Elementor 1.6.42
• Ultimate Addons for Elementor 1.6.43
• Ultimate Addons for Elementor 1.6.44
• Ultimate Addons for Elementor 1.6.45

Added additional permission checks to prevent unauthorized users from viewing or editing content. If the current user does not have the edit_post capability for the specified post, the code checks the post status (draft, private, pending) or whether the post is password-protected. If any of these conditions are met, access is blocked and an empty string is returned. This ensures that users without the proper permissions cannot view or modify restricted or protected posts.

This vulnerability affects the following application versions:

• Ultimate Addons for Elementor 1.1.0
• Ultimate Addons for Elementor 1.1.1
• Ultimate Addons for Elementor 1.1.2
• Ultimate Addons for Elementor 1.2.0
• Ultimate Addons for Elementor 1.2.1
• Ultimate Addons for Elementor 1.2.2
• Ultimate Addons for Elementor 1.3.0
• Ultimate Addons for Elementor 1.3.1
• Ultimate Addons for Elementor 1.4.0
• Ultimate Addons for Elementor 1.4.1
• Ultimate Addons for Elementor 1.5.0
• Ultimate Addons for Elementor 1.5.1
• Ultimate Addons for Elementor 1.5.2
• Ultimate Addons for Elementor 1.5.3
• Ultimate Addons for Elementor 1.5.4
• Ultimate Addons for Elementor 1.5.5
• Ultimate Addons for Elementor 1.5.6
• Ultimate Addons for Elementor 1.5.7
• Ultimate Addons for Elementor 1.5.8
• Ultimate Addons for Elementor 1.5.9
• Ultimate Addons for Elementor 1.6.0
• Ultimate Addons for Elementor 1.6.1
• Ultimate Addons for Elementor 1.6.2
• Ultimate Addons for Elementor 1.6.3
• Ultimate Addons for Elementor 1.6.4
• Ultimate Addons for Elementor 1.6.5
• Ultimate Addons for Elementor 1.6.6
• Ultimate Addons for Elementor 1.6.7
• Ultimate Addons for Elementor 1.6.8
• Ultimate Addons for Elementor 1.6.9
• Ultimate Addons for Elementor 1.6.10
• Ultimate Addons for Elementor 1.6.11
• Ultimate Addons for Elementor 1.6.12
• Ultimate Addons for Elementor 1.6.13
• Ultimate Addons for Elementor 1.6.14
• Ultimate Addons for Elementor 1.6.15
• Ultimate Addons for Elementor 1.6.16
• Ultimate Addons for Elementor 1.6.17
• Ultimate Addons for Elementor 1.6.18
• Ultimate Addons for Elementor 1.6.19
• Ultimate Addons for Elementor 1.6.20
• Ultimate Addons for Elementor 1.6.21
• Ultimate Addons for Elementor 1.6.22
• Ultimate Addons for Elementor 1.6.23
• Ultimate Addons for Elementor 1.6.24
• Ultimate Addons for Elementor 1.6.25
• Ultimate Addons for Elementor 1.6.26
• Ultimate Addons for Elementor 1.6.27
• Ultimate Addons for Elementor 1.6.28
• Ultimate Addons for Elementor 1.6.29
• Ultimate Addons for Elementor 1.6.30
• Ultimate Addons for Elementor 1.6.31
• Ultimate Addons for Elementor 1.6.32
• Ultimate Addons for Elementor 1.6.33
• Ultimate Addons for Elementor 1.6.34
• Ultimate Addons for Elementor 1.6.35
• Ultimate Addons for Elementor 1.6.36
• Ultimate Addons for Elementor 1.6.37
• Ultimate Addons for Elementor 1.6.38
• Ultimate Addons for Elementor 1.6.39
• Ultimate Addons for Elementor 1.6.40
• Ultimate Addons for Elementor 1.6.41
• Ultimate Addons for Elementor 1.6.42
• Ultimate Addons for Elementor 1.6.43