Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

7 records

Vendor: Crocoblock Component: Jetwidgets For Elementor Clear all filters
TI-2024-09564 CVE-2024-10323 · GHSA-x82c-r8c4-9m52

JetWidgets For Elementor <= 1.0.18 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

Priority LOW 28

The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 1.0.18 due to insufficient input sanitization and output…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00322 Published 2024-11-12 No fix listed CWE-79
TI-2024-04305 CVE-2024-4626 · GHSA-ffxp-mhmm-9288

Cross-site scripting in jetmonsters JetWidgets For Elementor

Priority LOW 28

The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘layout_type’ and 'id' parameters in all versions up to, and including, 1.0.17 due to insufficient input sanitization…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00322 Published 2024-06-20 No fix listed CWE-79
TI-2024-01988 CVE-2024-2138 · GHSA-62qp-h6pg-8q3g

JetWidgets For Elementor <= 1.0.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Box Widget

Priority LOW 29

The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Animated Box widget in all versions up to, and including, 1.0.15 due to insufficient input sanitization and output es…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00423 Published 2024-04-09 No fix listed CWE-79
TI-2024-02332 CVE-2024-2507 · GHSA-5qvc-39c2-6m74

JetWidgets For Elementor <= 1.0.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via Widget Button URL

Priority LOW 28

The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget button URL in all versions up to, and including, 1.0.16 due to insufficient input sanitization and output esca…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0034 Published 2024-04-09 No fix listed CWE-79
TI-2023-00032 CVE-2023-0034 · GHSA-8cwg-pj8f-8j23

JetWidgets For Elementor < 1.0.14 - Contributor+ Stored XSS via Shortcode

Priority MEDIUM 58

The JetWidgets For Elementor WordPress plugin before 1.0.14 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users w…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00477 Published 2023-02-13 Fixed in 1.0.14
TI-2021-06560 CVE-2021-24268 · GHSA-cvxv-m3wh-fqjf

JetWidgets For Elementor < 1.0.9 - Contributor+ Stored XSS

Priority LOW 25

The “JetWidgets For Elementor” WordPress Plugin before 1.0.9 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0059 Published 2021-05-05 Fixed in 1.0.9 CWE-79