elementor-themes
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFEDATA_EXFILTRATION
Full Analysis
- DATA_EXFILTRATION (LOW): Potential Information Disclosure via
$_SERVERexposure. - Evidence: In
resources/dynamic-tags.md, theElementor_Dynamic_Tag_Server_Variableclass allows selecting and rendering any key from the$_SERVERsuperglobal. - Details: While the output is sanitized with
wp_kses_post()to prevent XSS, this functionality allows users with access to the Elementor editor to view server-side variables. Depending on the server configuration, these variables might contain sensitive data such as internal file paths, environment variables, or session-related headers.
Audit Metadata