CVE-2026-19217

The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-19217 Royal Elementor Addons < 1.7.1065 - Contributor+ Stored XSS via Icon Box Widget

The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-19217

The Royal Addons for Elementor WordPress plugin, specifically versions before 1.7.1065 , contains a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is a failure to validate a widget setting used to construct an HTML tag before it is outputted. This flaw allows users with the Contr...

EUVD-2026-57108

The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-19217 Royal Elementor Addons < 1.7.1065 - Contributor+ Stored XSS via Icon Box Widget

The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-19217: Improper Neutralization of Input During Web Page Generation

The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

PT-2026-71033

The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-12801

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Range Slider 'data-label' and 'data-separator' attributes in all versions up to, and including, 3.5.43 due to insufficient input sanitization and output escaping. This makes it possible f...

EUVD-2026-54365

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Range Slider 'data-label' and 'data-separator' attributes in all versions up to, and including, 3.5.43 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2026-12801

The CVE-2026-12801 entry concerns the Ultra Addons for Contact Form 7 plugin (WordPress). Affected: all versions up to and including 3.5.43. Vulnerability: Stored Cross-Site Scripting via the Range Slider attributes data-label and data-separator, caused by insufficient input sanitization and insu...

CVE-2026-12801 Ultra Addons for Contact Form 7 <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Attributes

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Range Slider 'data-label' and 'data-separator' attributes in all versions up to, and including, 3.5.43 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2026-12801 Ultra Addons for Contact Form 7 <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Attributes

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Range Slider 'data-label' and 'data-separator' attributes in all versions up to, and including, 3.5.43 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2026-12801

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Range Slider 'data-label' and 'data-separator' attributes in all versions up to, and including, 3.5.43 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2026-12801: Improper Neutralization of Input During Web Page Generation

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Range Slider 'data-label' and 'data-separator' attributes in all versions up to, and including, 3.5.43 due to insufficient input sanitization and output escaping. This makes it possible f...

WordPress Ultra Addons for Contact Form 7 plugin <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Plugin Ultimate Addons for Contact Form 7 versions = 3.5.43...

CVE-2026-66688

Contributor Cross Site Scripting XSS in Ultimate Addons for Elementor = 1.45.2 versions...

CVE-2026-65502

Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons = 8.7.13 versions...

CVE-2026-25403

Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons = 3.0.5 versions...

CVE-2026-66688 WordPress Ultimate Addons for Elementor plugin <= 1.45.2 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Ultimate Addons for Elementor = 1.45.2 versions...

CVE-2026-66688 WordPress Ultimate Addons for Elementor plugin <= 1.45.2 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Ultimate Addons for Elementor = 1.45.2 versions...