CVE-2024-2662: Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.102 - Authenticated (Admin+) Command Injection
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to command injection in all versions up to, and including, 1.5.102. This is due to insufficient filtering of template attributes during the creation of HTML for custom widgets This makes it possible for authenticated attackers, with administrator-level access and above, to execute arbitrary commands on the server.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2662?
CVE-2024-2662 is considered a high severity vulnerability due to the potential for remote command execution.
How do I fix CVE-2024-2662?
To fix CVE-2024-2662, update the Unlimited Elements For Elementor plugin to version 1.5.103 or later.
Which versions are affected by CVE-2024-2662?
CVE-2024-2662 affects all versions of Unlimited Elements For Elementor up to and including 1.5.102.
What type of vulnerability is CVE-2024-2662?
CVE-2024-2662 is a command injection vulnerability that allows attackers to execute arbitrary commands.
Who is the vendor for CVE-2024-2662?
The vendor for CVE-2024-2662 is Unlimited Elements.