9055 matches found
CVE-2026-84904 King Addons for Elementor 51.1.56 - 51.1.80 - Author+ Missing Authorization via Image Optimizer
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownership of the targeted object, allowing...
CVE-2026-84902 King Addons for Elementor < 51.1.81 - Contributor+ Stored XSS via Template Catalog Import
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when importing template content into a page, allowing users with contributor-level access and above to overwrite the Elementor content of arbitrary posts and pages, including those...
PT-2026-95299
Name of the Vulnerable Software and Affected Versions Qi Addons For Elementor versions prior to 1.12 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when the Table of Contents widget is placed o...
CVE-2026-84903: Exposure of Sensitive Information to an Unauthorized Actor
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password check before rendering the content of a user-supplied post, allowing users with Contributor-level access and above to read the content of private, draft, pending, and...
CVE-2026-84904: Missing Authorization
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownership of the targeted object, allowing...
CVE-2026-92249: Improper Neutralization of Input During Web Page Generation
The Qi Addons For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 1.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary we...
PT-2026-95334
Name of the Vulnerable Software and Affected Versions Master Addons for Elementor versions prior to 3.2.3 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with contributor-level acce...
CVE-2026-84902: Improper Neutralization of Input During Web Page Generation
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when importing template content into a page, allowing users with contributor-level access and above to overwrite the Elementor content of arbitrary posts and pages, including those...
CVE-2026-85410: Missing Authorization
The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.2. This is due to the plugin not properly verifying that a user is...
CVE-2026-66626
Editor SQL Injection in SKT Addons for Elementor = 4.0 versions...
CVE-2026-66575
Unauthenticated Insecure Direct Object References IDOR in King Addons for Elementor = 51.1.81 versions...
CVE-2026-66574
Contributor Cross Site Scripting XSS in Element Pack Elementor Addons = 8.8.3 versions...
EUVD-2026-81508
Editor SQL Injection in SKT Addons for Elementor = 4.0 versions...
CVE-2026-66626
CVE-2026-66626 is an Editor SQL Injection vulnerability in the WordPress plugin SKT Addons for Elementor (versions ≤ 4.0 ), discovered by Ananda Dhakal via Patchstack. The flaw allows an authenticated user with high privileges to inject SQL through the editor functionality. The CVSS 3.1 score is ...
CVE-2026-66626 WordPress SKT Addons for Elementor plugin <= 4.0 - SQL Injection vulnerability
Editor SQL Injection in SKT Addons for Elementor = 4.0 versions...
CVE-2026-66626 WordPress SKT Addons for Elementor plugin <= 4.0 - SQL Injection vulnerability
Editor SQL Injection in SKT Addons for Elementor = 4.0 versions...
CVE-2026-66575 WordPress King Addons for Elementor plugin <= 51.1.81 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References IDOR in King Addons for Elementor = 51.1.81 versions...
CVE-2026-66575 WordPress King Addons for Elementor plugin <= 51.1.81 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References IDOR in King Addons for Elementor = 51.1.81 versions...