Medium severity4.3NVD Advisory· Published Oct 29, 2024· Updated Jun 17, 2026

CVE-2024-10360

Description

The Move Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.5 via the render function in includes/widgets/accordion/widget.php, includes/widgets/remote-template/widget.php, and other widget.php files. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Move Addons For Elementorllm-fuzzy2 versions
<=1.3.5+ 1 more
- (no CPE)range: <=1.3.5
- (no CPE)
Moveaddons/Move Addons For Elementor2 versions
cpe:2.3:a:moveaddons:move_addons_for_elementor:*:*:*:*:*:wordpress:*:*+ 1 more
- cpe:2.3:a:moveaddons:move_addons_for_elementor:*:*:*:*:*:wordpress:*:*range: <1.3.6
- (no CPE)range: 0

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changeset/3176341/move-addonsnvdPatch
www.wordfence.com/threat-intel/vulnerabilities/id/eafe73b4-b492-45c7-adca-d9a3042144b4nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000