9347 matches found
CVE-2026-14817
The Element Pack Addons for Elementor WordPress plugin, versions before 8.7.13 , is vulnerable to a DOM-based stored XSS flaw. The root cause is a failure to sanitize option values passed through certain data attributes before a bundled front-end library re-parses and renders them in the browser....
CVE-2026-14817
The Element Pack Addons for Elementor WordPress plugin before 8.7.13 does not sanitize option values passed through certain data attributes before a bundled front-end library re-parses and renders them in the browser, allowing users with contributor-level access or higher to inject arbitrary...
CVE-2026-14817 Element Pack Elementor Addons < 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data Attributes
The Element Pack Addons for Elementor WordPress plugin before 8.7.13 does not sanitize option values passed through certain data attributes before a bundled front-end library re-parses and renders them in the browser, allowing users with contributor-level access or higher to inject arbitrary...
WordPress Element Pack Addons for Elementor plugin < 8.7.13 - Contributor+ DOM-Based Stored XSS vulnerability
Contributor+ DOM-Based Stored XSS vulnerability discovered by Pierre Rudloff in WordPress Plugin Element Pack Elementor Addons versions 8.7.13...
CVE-2026-14841 King Addons for Elementor < 51.1.76 - Reflected XSS via Posts Grid Widget
The King Addons for Elementor WordPress plugin before 51.1.76 does not escape a user-supplied grid setting before reflecting it into an HTML attribute in an unauthenticated AJAX response, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who is tricked into loading a...
CVE-2026-14841
The King Addons for Elementor WordPress plugin (versions before 51.1.76 ) is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw. The issue occurs because the plugin fails to escape user-supplied grid settings before reflecting them into an HTML attribute within an unauthenticated AJAX resp...
EUVD-2026-51928
The King Addons for Elementor WordPress plugin before 51.1.76 does not escape a user-supplied grid setting before reflecting it into an HTML attribute in an unauthenticated AJAX response, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who is tricked into loading a...
CVE-2026-14841
The King Addons for Elementor WordPress plugin before 51.1.76 does not escape a user-supplied grid setting before reflecting it into an HTML attribute in an unauthenticated AJAX response, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who is tricked into loading a...
CVE-2026-14841 King Addons for Elementor < 51.1.76 - Reflected XSS via Posts Grid Widget
The King Addons for Elementor WordPress plugin before 51.1.76 does not escape a user-supplied grid setting before reflecting it into an HTML attribute in an unauthenticated AJAX response, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who is tricked into loading a...
PT-2026-67012
Name of the Vulnerable Software and Affected Versions Exclusive Addons for Elementor versions prior to 2.7.9.9 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access and above can inject...
PT-2026-67053
The King Addons for Elementor WordPress plugin before 51.1.76 does not escape a user-supplied grid setting before reflecting it into an HTML attribute in an unauthenticated AJAX response, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who is tricked into loading a...
PT-2026-67047
Name of the Vulnerable Software and Affected Versions Element Pack Addons for Elementor versions prior to 8.7.13 Description Insufficient sanitization of option values passed through data attributes allows users with contributor-level access or higher to perform a Cross-Site Scripting XSS attack...
CVE-2026-12231: Improper Neutralization of Input During Web Page Generation
The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ exadinfoboximage’ parameter in all versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...
CVE-2026-14841: Improper Neutralization of Input During Web Page Generation
The King Addons for Elementor WordPress plugin before 51.1.76 does not escape a user-supplied grid setting before reflecting it into an HTML attribute in an unauthenticated AJAX response, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who is tricked into loading a...
CVE-2026-14817: Improper Neutralization of Input During Web Page Generation
The Element Pack Addons for Elementor WordPress plugin before 8.7.13 does not sanitize option values passed through certain data attributes before a bundled front-end library re-parses and renders them in the browser, allowing users with contributor-level access or higher to inject arbitrary...
WordPress Exclusive Addons for Elementor plugin <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Exclusive Addons Elementor versions = 2.7.9.8...
CVE-2026-14921
The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.5's shared link-rendering function, UltimateVCAddons::uavclinkinit,...
WordPress ElementsKit Elementor Addons plugin < 3.10.01 - Subsite Administrator+ Stored XSS vulnerability
Subsite Administrator+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin ElementsKit Elementor addons Lite versions 3.10.01...
CVE-2026-14921
The Ultimate Addons for WPBakery Page Builder WordPress plugin, in versions prior to 3.21.5 , is vulnerable to Stored XSS . The flaw originates from the shared link-rendering function, Ultimate_VC_Addons::uavc_link_init(), and can be triggered via the ult_buttons shortcode. This vulnerability spe...