The Plus Addons For Elementor Page Builder
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:the_plus_addons_for_elementor_page_builder:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | The Plus Addons For Elementor Page Builder (b6597de4-9a20-50cd-b9b5-f41d6dedc212) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2021-24359 |
vulnerable | 2026-06-08 05:30:04.240860 |
The Plus Addons for Elementor Page Builder < 4.1.11 - Arbitrary Reset Pwd Email Sending
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.11 did not properly check that a user requesting a password reset was the legitimate user, allowing an attacker to send an arbitrary reset password email to a registered user on behalf of the WordPress site. Such issue could be chained with an open redirect (CVE-2021-24358) in version below 4.1.10, to include a crafted password reset link in the email, which would lead to an account takeover.
Published: 2021-06-14T13:37:14.000Z
Updated: 2024-08-03T19:28:23.838Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24358 |
vulnerable | 2026-06-08 05:30:04.240511 |
The Plus Addons for Elementor Page Builder < 4.1.10 - Open Redirect
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.10 did not validate a redirect parameter on a specifically crafted URL before redirecting the user to it, leading to an Open Redirect issue.
Published: 2021-06-14T13:37:14.000Z
Updated: 2024-08-03T19:28:23.441Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24351 |
vulnerable | 2026-06-08 05:30:04.233863 |
The Plus Addons for Elementor < 4.1.12 - Reflected Cross-Site Scripting (XSS)
The theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.12 did not properly sanitise some of its fields, leading to a reflected Cross-Site Scripting (exploitable on both unauthenticated and authenticated users)
Published: 2021-06-14T13:37:13.000Z
Updated: 2024-08-03T19:28:23.522Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24175 |
vulnerable | 2026-06-08 05:30:03.915145 |
The Plus Addons for Elementor Page Builder < 4.1.7 - Authentication Bypass
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.7 was being actively exploited to by malicious actors to bypass authentication, allowing unauthenticated users to log in as any user (including admin) by just providing the related username, as well as create accounts with arbitrary roles, such as admin. These issues can be exploited even if registration is disabled, and the Login widget is not active.
Published: 2021-04-05T18:27:44.000Z
Updated: 2024-08-03T19:21:18.637Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.