CVE-2024-49271: unlimited elements unlimited elements for elementor (free widgets, addons, templates)

Vulnerability summary

CVE-2024-49271 is a critical (CVSS 9.1) vulnerability in unlimited elements unlimited elements for elementor (free widgets, addons, templates). EPSS estimates a 1.14% chance of exploitation in the next 30 days, higher than 66% of scored vulnerabilities. Fixed in 1.5.122.

Timeline

1. 16-10-2024
   PublishedVulnerability first disclosed.
2. 28-04-2026
   Last modifiedVulnerability information updated.

Description

Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Command Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through <= 1.5.121.

• CWE-82Improper Neutralization of Script in Attributes of IMG Tags in a Web PageThe web application does not neutralize or incorrectly neutralizes scripting elements within attributes of HTML IMG tags, such as the src attribute.
• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.