cve/2022/CVE-2022-4953.md

CVE-2022-4953

Description

The Elementor Website Builder WordPress plugin before 3.5.5 does not filter out user-controlled URLs from being loaded into the DOM. This could be used to inject rogue iframes that point to malicious URLs.

POC

Reference

• http://packetstormsecurity.com/files/174550/WordPress-Elementor-Iframe-Injection.html
• https://wpscan.com/vulnerability/8273357e-f9e1-44bc-8082-8faab838eda7

Github

No PoCs found on GitHub currently.