| Package | Affected versions | Patched versions |
|---|---|---|
| website builder | < 3.5.5 | 3.5.5 |
The Elementor Website Builder WordPress plugin before 3.5.5 does not filter out user-controlled URLs from being loaded into the DOM. This could be used to inject rogue iframes that point to malicious URLs.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free