Conversation
supportDuring a security audit of our website, we identified that ElementsKit Lite bundles an internal copy of Bootstrap 4.0.0 inside widgets/init/assets/js/widget-scripts.js , labeled in the code as “Ekit Prefixed Bootstrap.” Bootstrap 4.0.0 is affected by several known XSS vulnerabilities (CVE-2018-14040, CVE-2018-14041, CVE-2018-14042, CVE-2019-8331), which were patched in Bootstrap 4.1.2 and later. We have confirmed this bundled copy is present in the latest release (v3.9.3) and has not been updated in any published version. We would like to request that the bundled Bootstrap dependency be updated to a patched version (4.6.x or 5.x) in a future release. Thank you.
Hi glampetsts , Thank you for bringing this to our attention. We are already aware of this concern, and our development team is currently working on removing the Bootstrap dependency from ElementsKit Lite . We are moving toward implementing our own CSS framework, which will provide better security, stability, and overall performance. We appreciate your detailed report and your contribution to improving the plugin. Thank you for your understanding. Regards, Ikbal
@glampetsts CVE-2018-14040 was patched in 3.4.0 CVE-2018-14041 does not exist in bootstrap 3.3.7 or above CVE-2018-14042 was patched in 3.4.0 https://github.com/advisories/GHSA-7mvr-5x2g-wfc8 CVE-2019-8331 was fixed in version 3.4.1 Anyway @tusherikbal please update bootstrap to version 3.4.1 which is easy and fixes 3 vulnerabilities that exist in bootstrap 3.3.7. You can just update the bootstrap.js and bootstrap.css to version 3.4.1 without loosing functionality of your plugin. They are almost 100% the same except the fix for the 2 vulnerabilities v3.4.1 Security: Fixed an XSS vulnerability ( CVE-2019-8331 ) in our tooltip and popover plugins by implementing a new HTML sanitizer v3.4.0 Fixed: Resolved an XSS issue in Alert, Carousel, Collapse, Dropdown, Modal, and Tab components. See https://snyk.io/vuln/npm:bootstrap:20160627 for details. https://www.herodevs.com/support/nes-bootstrap?utm_source=Bootstrap_site&utm_medium=Banner&utm_campaign=v3and4_eol
@tusherikbal i can send you a modified bootstrap 3.4.1 version that fixes all security issues also the on the one that is not fixed in v 3.4.1 (cve-2025-2647). It is very easy to fix your selves and that closes all security issues with bootstrap below version 4 https://www.herodevs.com/vulnerability-directory/cve-2025-1647?nes-for-bootstrap
Hi, Thank you for sharing this information and for your effort in helping us improve security. We truly appreciate your suggestion and the resources you provided regarding the Bootstrap vulnerabilities and fixes. Our development team is already reviewing and working on the related security improvements internally. Your feedback is valuable to us and will certainly help during the investigation and update process. Thank you again for your cooperation and support. Best regards, Ikbal
Dear @everyone , I hope you are doing well. We are pleased to inform you that we have resolved this issue on our end. The fix will be included in the next version of the ElementsKit plugin. Once the new version is released, kindly update your ElementsKit plugin to receive the fix. Thank you for your patience and cooperation. Best Regards, Reju
Hi glampetsts , Thank you for bringing this to our attention. We are already aware of this concern, and our development team is currently working on removing the Bootstrap dependency from ElementsKit Lite . We are moving toward implementing our own CSS framework, which will provide better security, stability, and overall performance. We appreciate your detailed report and your contribution to improving the plugin. Thank you for your understanding. Regards, Ikbal
@glampetsts CVE-2018-14040 was patched in 3.4.0 CVE-2018-14041 does not exist in bootstrap 3.3.7 or above CVE-2018-14042 was patched in 3.4.0 https://github.com/advisories/GHSA-7mvr-5x2g-wfc8 CVE-2019-8331 was fixed in version 3.4.1 Anyway @tusherikbal please update bootstrap to version 3.4.1 which is easy and fixes 3 vulnerabilities that exist in bootstrap 3.3.7. You can just update the bootstrap.js and bootstrap.css to version 3.4.1 without loosing functionality of your plugin. They are almost 100% the same except the fix for the 2 vulnerabilities v3.4.1 Security: Fixed an XSS vulnerability ( CVE-2019-8331 ) in our tooltip and popover plugins by implementing a new HTML sanitizer v3.4.0 Fixed: Resolved an XSS issue in Alert, Carousel, Collapse, Dropdown, Modal, and Tab components. See https://snyk.io/vuln/npm:bootstrap:20160627 for details. https://www.herodevs.com/support/nes-bootstrap?utm_source=Bootstrap_site&utm_medium=Banner&utm_campaign=v3and4_eol
@tusherikbal i can send you a modified bootstrap 3.4.1 version that fixes all security issues also the on the one that is not fixed in v 3.4.1 (cve-2025-2647). It is very easy to fix your selves and that closes all security issues with bootstrap below version 4 https://www.herodevs.com/vulnerability-directory/cve-2025-1647?nes-for-bootstrap
Hi, Thank you for sharing this information and for your effort in helping us improve security. We truly appreciate your suggestion and the resources you provided regarding the Bootstrap vulnerabilities and fixes. Our development team is already reviewing and working on the related security improvements internally. Your feedback is valuable to us and will certainly help during the investigation and update process. Thank you again for your cooperation and support. Best regards, Ikbal
Dear @everyone , I hope you are doing well. We are pleased to inform you that we have resolved this issue on our end. The fix will be included in the next version of the ElementsKit plugin. Once the new version is released, kindly update your ElementsKit plugin to receive the fix. Thank you for your patience and cooperation. Best Regards, Reju