CVEs-PoC/2022/CVE-2022-4953.md

CVE-2022-4953

Description

The Elementor Website Builder WordPress plugin before 3.5.5 does not filter out user-controlled URLs from being loaded into the DOM. This could be used to inject rogue iframes that point to malicious URLs.

POC

Reference

• http://packetstormsecurity.com/files/174550/WordPress-Elementor-Iframe-Injection.html
• https://wpscan.com/vulnerability/8273357e-f9e1-44bc-8082-8faab838eda7

Github

• https://github.com/20142995/nuclei-templates
• https://github.com/Wayne-Ker/WordPress-Elementor-Plugin-3.5.5-XSS-or-iFrame-Injection-POC
• https://github.com/abyasham/vulnerability-prioritize-epss-ssvc
• https://github.com/miguelsantareno/miguelsantareno