CVE-2022-4953

Elementor < 3.5.5 - Iframe Injection

published August 14, 2023

CVSS
—
EPSS
3%
Percentile
88.8
In the wild
Unconfirmed
What it is

The Elementor Website Builder WordPress plugin before 3.5.5 does not filter out user-controlled URLs from being loaded into the DOM. This could be used to inject rogue iframes that point to malicious URLs.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03410 · 88.8th percentile
Published
2023-08-14T19:10Z
EPSS history
Timeline
  • 14 AUG 19:10Z
    Elementor < 3.5.5 - Iframe Injection
    cvelistv5