CVE-2022-4953

Deeper analysis

The Elementor Website Builder WordPress plugin before version 3.5.5 contains a vulnerability in which user-controlled URLs are not filtered before being loaded into the DOM, enabling the injection of rogue iframes that reference arbitrary external locations. The affected component is the core URL handling logic within the page builder that renders user-supplied content without sufficient sanitization.

An unauthenticated remote attacker can supply a crafted URL that triggers the flaw when a victim interacts with the resulting page. Successful exploitation allows the attacker to load malicious iframes under the context of the vulnerable site, resulting in limited impacts to confidentiality and integrity as reflected in the CVSS 6.1 rating.

Public references point to a GitHub commit that addresses the issue by adding URL filtering and to a WPScan advisory that documents the affected versions; the recommended mitigation is to update the plugin to 3.5.5 or later. The EPSS score has remained in a moderate range with a recorded peak of 0.1338 and current value of 0.1154.