bdthemes Vulnerabilities and Affected Products
Vulnerabilities associated with Ultimate Post Kit Addons for Elementor.
Products
Clear product- Element Pack – Widgets, Templates & Addons for Elementor29 vulnerabilities
- Prime Slider – Addons for Elementor17 vulnerabilities
- Ultimate Store Kit Elementor Addons12 vulnerabilities
- Element Pack Elementor Addons9 vulnerabilities
- Element Pack Pro4 vulnerabilities
- prime_slider4 vulnerabilities
- ZoloBlocks4 vulnerabilities
- Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor3 vulnerabilities
- Instant Image Generator2 vulnerabilities
- Ultimate Post Kit Addons for Elementor2 vulnerabilities
- utlimate_store_kit_elementor_addons2 vulnerabilities
- ZoloBlocks – Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates & Patterns2 vulnerabilities
- Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons1 vulnerability
- Element Pack Elementor Addons and Templates1 vulnerability
- Element Pack Pro - Addon for Elementor Page Builder WordPress Plugin1 vulnerability
- element_pack_elementor_addons1 vulnerability
- instant_image_generator1 vulnerability
- Live Copy Paste for Elementor1 vulnerability
- Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery1 vulnerability
- SigmaForms Pro – AI Generated Forms1 vulnerability
- Spin Wheel – Interactive spinning wheel that offers coupons1 vulnerability
- Ultimate Post Kit1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2022-4974MEDIUM | Freemius SDK <= 2.4.2 - Missing Authorization ChecksThe Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable. CWE-862Oct 16, 2024 | CVSS6.3v3.1 | EPSS0.442% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-5662MEDIUM | Ultimate Post Kit Addons For Elementor – (Post Grid, Post Carousel, Post Slider, Category List, Post Tabs, Timeline, Post Ticker, Tag Cloud) <= 3.11.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Count (Static) WidgetThe Ultimate Post Kit Addons For Elementor – (Post Grid, Post Carousel, Post Slider, Category List, Post Tabs, Timeline, Post Ticker, Tag Cloud) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the Social Count (Static) widget in all versions up to, and including, 3.11.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scr… CWE-79Jun 28, 2024 | CVSS6.4v3.1 | EPSS0.4% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |