Threats tagged 'ghsa-v7rm-2jj2-cc35'

ElementsKit Elementor Addons WordPress plugin versions before 3.10.01 contain a code injection vulnerability. This flaw allows a user with administrative capabilities to save a custom-widget definition that is written verbatim into a PHP file and executed by the plugin, enabling arbitrary PHP code execution on the server. In multisite networks, this can allow a non-super subsite Administrator to escalate privileges to host-level code execution beyond their granted permissions.