Vulnerabilities (CVE)

Filtered by vendor Detheme Subscribe
Filtered by product Dethemekit For Elementor
Total 2 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2024-6283 1 Detheme 1 Dethemekit For Elementor 2024-11-21 N/A 5.4 MEDIUM
The DethemeKit For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL parameter of the De Gallery widget in all versions up to and including 2.1.5 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user clicks on the injected link.
CVE-2021-24270 1 Detheme 1 Dethemekit For Elementor 2024-11-21 3.5 LOW 5.4 MEDIUM
The “DeTheme Kit for Elementor” WordPress Plugin before 1.5.5.5 has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.