Elementor < 3.5.5 - Iframe Injection
23Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendepss 2.9%
from disclosure to weapon25 days
Published on NVDAug 14
1st PoC+25d
exploitation probability
2.9%top 15% of all CVEs
observed exploitation
nono source reports it
2 public exploit(s)
The Elementor Website Builder WordPress plugin before 3.5.5 does not filter out user-controlled URLs from being loaded into the DOM. This could be used to inject rogue iframes that point to malicious URLs.
Affected products
Unknown · Elementor Website Builderpublic PoCs found — 2
exploitdbwww.exploit-db.com/exploits/51716unverifiedcve_referencewpscan.com/vulnerability/8273357e-f9e1-44bc-8082-8faab838eda7unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.