CVE-2021-42360

On sites that also had the Elementor plugin for WordPress installed, it was possible for users with the edit_posts capability, which includes Contributor-level users, to import blocks onto any page using the astra-page-elementor-batch-process AJAX action. An attacker could craft and host a block containing malicious JavaScript on a server they controlled, and then use it to overwrite any post or page by sending an AJAX request with the action set to astra-page-elementor-batch-process and the url parameter pointed to their remotely-hosted malicious block, as well as an id parameter containing the post or page to overwrite. Any post or page that had been built with Elementor, including published pages, could be overwritten by the imported block, and the malicious JavaScript in the imported block would then be executed in the browser of any visitors to that page.

• CWE-79
• CWE-99
• CWE-284

• https://www.wordfence.com/blog/2021/11/over-1-million-sites-impacted-by-vulnerability-in-starter-templates-plugin/Exploit, Third Party Advisory
• https://www.wordfence.com/blog/2021/11/over-1-million-sites-impacted-by-vulnerability-in-starter-templates-plugin/Exploit, Third Party Advisory

Published

Nov 17, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-42343An issue was discovered in the Dask distributed package befo…9.8
• CVE-2021-4235Due to unbounded alias chasing, a maliciously crafted YAML f…5.5
• CVE-2021-42357When using Apache Knox SSO prior to 1.6.1, a request could b…6.1
• CVE-2021-42358The Contact Form With Captcha WordPress plugin is vulnerable…8.8
• CVE-2021-42359WP DSGVO Tools (GDPR) <= 3.1.23 had an AJAX action, ‘admin-d…9.1
• CVE-2021-4236Web Sockets do not execute any AuthenticateMethod methods wh…9.8
• CVE-2021-42361The Contact Form Email WordPress plugin is vulnerable to Sto…4.8
• CVE-2021-42362The WordPress Popular Posts WordPress plugin is vulnerable t…8.8
• CVE-2021-42363The Preview E-Mails for WooCommerce WordPress plugin is vuln…6.1
• CVE-2021-42364The Stetic WordPress plugin is vulnerable to Cross-Site Requ…8.8
• CVE-2021-42365The Asgaros Forums WordPress plugin is vulnerable to Stored …4.8
• CVE-2021-42367The Variation Swatches for WooCommerce WordPress plugin is v…5.4