CVE-2026-66626

Editor SQL Injection in SKT Addons for Elementor = 4.0 versions...

EUVD-2026-81508

Editor SQL Injection in SKT Addons for Elementor = 4.0 versions...

CVE-2026-66626

CVE-2026-66626 is an Editor SQL Injection vulnerability in the WordPress plugin SKT Addons for Elementor (versions ≤ 4.0 ), discovered by Ananda Dhakal via Patchstack. The flaw allows an authenticated user with high privileges to inject SQL through the editor functionality. The CVSS 3.1 score is ...

EUVD-2026-81496

Unauthenticated Insecure Direct Object References IDOR in King Addons for Elementor = 51.1.81 versions...

CVE-2026-66575

King Addons for Elementor WordPress plugin versions

CVE-2026-66575 WordPress King Addons for Elementor plugin <= 51.1.81 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in King Addons for Elementor = 51.1.81 versions...

essential-addons-for-elementor-xss-poc

🔍 Essential Addons for Elementor XSS脆弱性検出ツール 🚨 重要情報 このツールはセキュリティ研究およびパッチ適用目的のみに使用してください。サイトに害を及ぼすために使用しないでください。脆弱なサイトを見つけた場合は、サイト所有者に責任を持って報告し、直ちに更新してもらうようにしてください。 ⚠️ 脆弱性の詳細 Essential Addons for Elementorにおける反射型XSS脆弱性が、バージョン6.0.15未満を使用している10万以上のウェブサイトに影響を与えます。これには CVE-2025-24752 が割り当てられています。 👉...

WordPress King Addons for Elementor plugin <= 51.1.81 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Sakri Rafael Koskimies in WordPress Plugin King Addons for Elementor versions = 51.1.81...

CVE-2026-91015

The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only on a nonce that is publicly output to every visitor, allowing unauthenticated attackers to permanently disable any popup...

CVE-2026-86788

The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in several of its widgets and blocks to a safe allowlist, allowing users with contributor-level access and above to store a crafted tag name that executes arbitra...

EUVD-2026-81356

The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only on a nonce that is publicly output to every visitor, allowing unauthenticated attackers to permanently disable any popup...

CVE-2026-91015

The Master Addons for Elementor WordPress plugin before 3.1.9 lacks a proper authorization check on the AJAX action jltma_popup_disable_expired, which deactivates its Popup Builder popups. The only safeguard is a nonce that is publicly output to every visitor, making it accessible to unauthentica...

CVE-2026-91015 Master Addons for Elementor < 3.1.9 - Unauthenticated Popup Deactivation via jltma_popup_disable_expired

The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only on a nonce that is publicly output to every visitor, allowing unauthenticated attackers to permanently disable any popup...

CVE-2026-86788 HT Mega 3.2.0 - 3.2.5 - Contributor+ Stored XSS via Section Headline Tag

The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in several of its widgets and blocks to a safe allowlist, allowing users with contributor-level access and above to store a crafted tag name that executes arbitra...

EUVD-2026-81342

The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in several of its widgets and blocks to a safe allowlist, allowing users with contributor-level access and above to store a crafted tag name that executes arbitra...

WordPress The Plus Addons for Elementor <4.1.12 - Cross-Site Scripting

WordPress The Plus Addons for Elementor plugin before 4.1.12 is susceptible to cross-site scripting. The plugin does not properly sanitize some of its fields in the heplusmorepost AJAX action, which is exploitable by both unauthenticated and authenticated users. An attacker can inject arbitrary...

CVE-2026-62109

Editor SQL Injection in Sky Addons for Elementor = 3.8.4 versions...

PT-2026-86349

🚨 CVE-2026-84896 The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before outputting it in an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of any visitor to the...

EUVD-2026-63201

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manageoptions capability and, on WordPress Multisite, non-super subsite administrators who do not otherwise...

CVE-2026-17565

The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using it to build the host of a server-side HTTP request, allowing unauthenticated users to make the site issue requests to internal hosts and read the responses back...