Access violation vulnerability in XLTab – Accordions and Tabs for Elementor Page Builder 1.4

The XLTab plugin for WordPress, which is used with the Elementor Page Builder, has a security vulnerability that allows for the exposure of information. This vulnerability affects all versions of the plugin, up to and including version 1.4. The issue is related to a shortcode called ‘XLTAB_INSERT_TPL’ and the fact that it does not have proper restrictions in place for which posts it can access. This means that users with Contributor-level access or higher can potentially view data from private or draft posts created with Elementor, even if they should not have permission to do so.