High severity7.5NVD Advisory· Published Jan 10, 2022· Updated Jun 17, 2026

CVE-2021-24948

Description

The Plus Addons for Elementor - Pro WordPress plugin before 5.0.7 does not validate the qvquery parameter of the tp_get_dl_post_info_ajax AJAX action, which could allow unauthenticated users to retrieve sensitive information, such as private and draft posts

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Plus Addons for Elementor - Prodescription
WordPress/Pro Addons For Elementorllm-fuzzy
Range: <5.0.7
Package: https://wordpress.org/plugins/pro-addons-for-elementor

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/2b67005a-476e-4772-b15c-3191911a50b0nvdExploitThird Party Advisory
roadmap.theplusaddons.com/updatesnvdRelease NotesVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000