Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Settings
Sign in
🔥 Daily Hot!
💪🏽 CPE Enhanced Advisories
🕶 Shadow Exploits
🕵🏼 Vulners CPE
🔐 Security news
💻 Exploit updates
📑 Blogs review
🐧 Linux vulnerabilities
🐞 Bugbounty
🤖 AI High Score
📰 CVE Feed
show all

7443 matches found

GithubExploit
GithubExploit•added 2026/04/05 10:8 p.m.•192 views

Exploit for Cross-site Scripting in Exclusiveaddons Exclusive_Addons_For_Elementor

WP-Hunter MCP - Autonomous Bug Bounty Hunting MCP SERVER...

9.8CVSS6.3AI score0.07893EPSS
SaveExploits15
RedhatCVE
RedhatCVE•added 2026/04/05 10:55 a.m.•8 views

CVE-2025-13368

The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Pricing Widget's 'onClick Event' setting in all versions up to, and including, 1.4.20 due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS6.1AI score0.00195EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE•added 2026/04/05 10:55 a.m.•8 views

CVE-2026-0664

The Royal Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buttontext' parameter in all versions up to, and including, 1.7.1049 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

6.4CVSS6.1AI score0.00293EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE•added 2026/04/05 5:7 a.m.•5 views

CVE-2026-2949

The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Icon Box widget in versions up to, and including, 1.4.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

6.4CVSS6.1AI score0.00159EPSS
SaveExploits0References1
EUVD
EUVD•added 2026/04/04 9:30 a.m.•7 views

EUVD-2025-209215

The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Pricing Widget's 'onClick Event' setting in all versions up to, and including, 1.4.20 due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS6.1AI score0.00195EPSS
SaveExploits0References3
NVD
NVD•added 2026/04/04 8:16 a.m.•15 views

CVE-2026-0664

The Royal Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buttontext' parameter in all versions up to, and including, 1.7.1049 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

6.4CVSS0.00293EPSS
SaveExploits0References2
NVD
NVD•added 2026/04/04 8:16 a.m.•14 views

CVE-2025-13368

The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Pricing Widget's 'onClick Event' setting in all versions up to, and including, 1.4.20 due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS0.00195EPSS
SaveExploits0References2
Cvelist
Cvelist•added 2026/04/04 7:41 a.m.•46 views

CVE-2025-13368 Xpro Addons — 140+ Widgets for Elementor <= 1.4.20 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Pricing Widget's 'onClick Event' setting in all versions up to, and including, 1.4.20 due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS0.00195EPSS
SaveExploits0References2
CVE
CVE•added 2026/04/04 7:41 a.m.•29 views

CVE-2025-13368

The CVE-2025-13368 entry concerns the WordPress plugin Xpro Addons — 140+ Widgets for Elementor . It is vulnerable to Stored Cross-Site Scripting via the Pricing Widget’s onClick Event setting in all versions up to and including 1.4.20, caused by insufficient input sanitization and output escapin...

6.4CVSS6.1AI score0.00195EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB•added 2026/04/04 7:41 a.m.•3 views

CVE-2025-13368

The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Pricing Widget's 'onClick Event' setting in all versions up to, and including, 1.4.20 due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS6.1AI score0.00195EPSS
SaveExploits0References3
Cvelist
Cvelist•added 2026/04/04 7:41 a.m.•31 views

CVE-2026-0664 Royal Elementor Addons <= 1.7.1049 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API Meta Bypass

The Royal Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buttontext' parameter in all versions up to, and including, 1.7.1049 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

6.4CVSS0.00293EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment•added 2026/04/04 7:41 a.m.•5 views

CVE-2026-0664 Royal Elementor Addons <= 1.7.1049 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API Meta Bypass

The Royal Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buttontext' parameter in all versions up to, and including, 1.7.1049 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

6.4CVSS6.1AI score0.00293EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB•added 2026/04/04 7:41 a.m.•6 views

CVE-2026-0664

The Royal Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buttontext' parameter in all versions up to, and including, 1.7.1049 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

6.4CVSS6.1AI score0.00293EPSS
SaveExploits0References3
CVE
CVE•added 2026/04/04 7:41 a.m.•32 views

CVE-2026-0664

The Royal Addons for Elementor plugin for WordPress is affected by a Stored Cross-Site Scripting (XSS) flaw via the button_text parameter in versions up to 1.7.1049, caused by insufficient input sanitization and output escaping. Authenticated attackers with contributor+ privileges can inject scri...

6.4CVSS6.1AI score0.00293EPSS
SaveExploits0References2
EUVD
EUVD•added 2026/04/04 6:30 a.m.•13 views

EUVD-2026-18969

The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Icon Box widget in versions up to, and including, 1.4.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

6.4CVSS6.1AI score0.00159EPSS
SaveExploits0References3
NVD
NVD•added 2026/04/04 4:17 a.m.•5 views

CVE-2026-2949

The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Icon Box widget in versions up to, and including, 1.4.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

6.4CVSS0.00159EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB•added 2026/04/04 2:26 a.m.•1 views

CVE-2026-2949

The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Icon Box widget in versions up to, and including, 1.4.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

6.4CVSS6.1AI score0.00159EPSS
SaveExploits0References3
CVE
CVE•added 2026/04/04 2:26 a.m.•14 views

CVE-2026-2949

The CVE-2026-2949 entry describes a Stored Cross-Site Scripting vulnerability in the WordPress plugin Xpro Addons — 140+ Widgets for Elementor . The issue affects versions up to and including 1.4.24 , caused by insufficient input sanitization and output escaping in the Icon Box widget. Exploitati...

6.4CVSS6.1AI score0.00159EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment•added 2026/04/04 2:26 a.m.•1 views

CVE-2026-2949 Xpro Addons — 140+ Widgets for Elementor <= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Box Widget

The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Icon Box widget in versions up to, and including, 1.4.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

6.4CVSS6.1AI score0.00159EPSS
SaveExploits0References2
Cvelist
Cvelist•added 2026/04/04 2:26 a.m.•30 views

CVE-2026-2949 Xpro Addons — 140+ Widgets for Elementor <= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Box Widget

The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Icon Box widget in versions up to, and including, 1.4.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

6.4CVSS0.00159EPSS
SaveExploits0References2
Rows per page
Query Builder