PT-2021-15810 · WordPress · Dethemekit For Elementor

Ramuel Gall · Published 2021-05-05 · Updated 2024-06-28 · CVE-2021-24270

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions DeTheme Kit for Elementor version 1.5.5.5 and earlier

Description The issue concerns a stored Cross-Site Scripting (XSS) vulnerability in a widget of the DeTheme Kit for Elementor WordPress Plugin. This vulnerability can be exploited by lower-privileged users, such as contributors. The exploitation method is similar in nature.

Recommendations For DeTheme Kit for Elementor versions prior to 1.5.5.5, update to version 1.5.5.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable widget to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24270

Affected Products

Dethemekit For Elementor

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-24270 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24270 · Vendor Advisory
• https://wpscan.com/vulnerability/67967784-18b6-4e41-9597-3a4c051f3978 · Note
• https://wordfence.com/blog/2021/04/recent-patches-rock-the-elementor-ecosystem · Note
• https://t.me/cvenotify/14101 · Telegram Post