High severity8.1NVD Advisory· Published Nov 22, 2024· Updated Jun 17, 2026
CVE-2024-11104
CVE-2024-11104
Description
The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the save_options() function in all versions up to, and including, 2.6.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. Please note this is limited to option values that can be saved as arrays.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3<=2.6.2+ 1 more
- (no CPE)range: <=2.6.2
- (no CPE)
- wowdevs/Sky Addons – Elementor Addons with Widgets & Templatesv5Range: 0
Patches
Vulnerability mechanics
References
5- plugins.trac.wordpress.org/changesetnvdPatch
- plugins.trac.wordpress.org/changesetnvdPatch
- www.wordfence.com/threat-intel/vulnerabilities/id/2a9810a8-311a-424a-bd64-8d25ee891bb5nvdThird Party Advisory
- plugins.trac.wordpress.org/browser/sky-elementor-addons/tags/2.6.1/includes/admin.phpnvdProduct
- plugins.trac.wordpress.org/browser/sky-elementor-addons/tags/2.6.1/includes/admin.phpnvdProduct
News mentions
0No linked articles in our index yet.