Cross-Site Request Forgery in JetWidgets for Elementor Plugin by WordPress

CVE-2023-0086

Summary

The JetWidgets for Elementor plugin for WordPress is susceptible to a Cross-Site Request Forgery vulnerability due to a lack of nonce validation in its save() function, affecting versions up to and including 1.0.12. This security flaw could allow unauthenticated attackers to trick site administrators into performing unwarranted actions, such as changing plugin settings or enabling potentially harmful features like SVG uploads. If exploited, this could lead to further vulnerabilities, including Cross-Site Scripting attacks.

References