Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Settings
Sign in
🔥 Daily Hot!
💪🏽 CPE Enhanced Advisories
🕶 Shadow Exploits
🕵🏼 Vulners CPE
🔐 Security news
💻 Exploit updates
📑 Blogs review
🐧 Linux vulnerabilities
🐞 Bugbounty
🤖 AI High Score
📰 CVE Feed
show all

7454 matches found

EUVD
EUVD•added 2026/03/02 5:23 p.m.•12 views

EUVD-2026-9222

The Master Addons for Elementor Premium plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.1.3 via the 'JLTMAWidgetAdmin::renderpreview'. This is due to missing capability check. This makes it possible for authenticated attackers, with...

8.8CVSS6.2AI score0.00596EPSS
SaveExploits0References3
Cvelist
Cvelist•added 2026/03/02 5:23 p.m.•38 views

CVE-2026-3132 Master Addons for Elementor Premium <= 2.1.3 - Authenticated (Subscriber+) Remote Code Execution via render_preview

The Master Addons for Elementor Premium plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.1.3 via the 'JLTMAWidgetAdmin::renderpreview'. This is due to missing capability check. This makes it possible for authenticated attackers, with...

8.8CVSS0.00596EPSS
SaveExploits0References3
Patchstack
Patchstack•added 2026/03/02 12:24 p.m.•11 views

WordPress Ultimate Addons for WPBakery Page Builder plugin <= 3.21.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Ultimate Addons for WPBakery Page Builder versions = 3.21.1...

6.5CVSS5.9AI score0.00279EPSS
SaveExploits0Affected Software1
Positive Technologies
Positive Technologies•added 2026/03/02 12:0 a.m.•26 views

PT-2026-22659

Name of the Vulnerable Software and Affected Versions Master Addons for Elementor Premium plugin for WordPress versions up to and including 2.1.3 Description The Master Addons for Elementor Premium plugin for WordPress is susceptible to Remote Code Execution via the JLTMA Widget Admin::render...

8.8CVSS6.2AI score0.00596EPSS
SaveExploits0References11
Packet Storm
Packet Storm•added 2026/03/02 12:0 a.m.•225 views

📄 WordPress King Addons for Elementor 51.1.14 Privilege Escalation

Proof of concept for a WordPress King Addons for Elementor plugin versions 24.12.92 through 51.1.14 unauthenticated privilege escalation vulnerability. ============================================================================================================================================= |...

9.8CVSS5.9AI score0.0927EPSS
SaveExploits4
Patchstack
Patchstack•added 2026/03/01 3:18 p.m.•10 views

WordPress PowerPack Addons for Elementor plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Abu Hurayra in WordPress Plugin PowerPack Addons for Elementor versions = 2.9.9...

6.5CVSS5.8AI score0.00161EPSS
SaveExploits0Affected Software1
Patchstack
Patchstack•added 2026/03/01 10:34 a.m.•8 views

WordPress Magical Addons For Elementor plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Abu Hurayra in WordPress Plugin Magical Addons For Elementor versions = 1.4.1...

6.5CVSS5.8AI score0.00161EPSS
SaveExploits0Affected Software1
RedhatCVE
RedhatCVE•added 2026/02/28 7:47 a.m.•17 views

CVE-2025-14149

The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Scroller widget box link attribute in all versions up to, and including, 1.4.24 due to insufficient input sanitization and output escaping on user supplied...

6.4CVSS6.1AI score0.00215EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE•added 2026/02/28 1:55 a.m.•10 views

CVE-2026-27457

Weblate is a web based localization tool. Prior to version 5.16.1, the REST API's AddonViewSet weblate/api/views.py, line 2831 uses queryset = Addon.objects.all without overriding getqueryset to scope results by user permissions. This allows any authenticated user or anonymous users if REQUIRELOG...

4.3CVSS5.9AI score0.00303EPSS
SaveExploits0References1
NVD
NVD•added 2026/02/27 7:17 a.m.•8 views

CVE-2025-14149

The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Scroller widget box link attribute in all versions up to, and including, 1.4.24 due to insufficient input sanitization and output escaping on user supplied...

6.4CVSS0.00215EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB•added 2026/02/27 6:43 a.m.•6 views

CVE-2025-14149

The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Scroller widget box link attribute in all versions up to, and including, 1.4.24 due to insufficient input sanitization and output escaping on user supplied...

6.4CVSS6AI score0.00215EPSS
SaveExploits0References3
CVE
CVE•added 2026/02/27 6:43 a.m.•25 views

CVE-2025-14149

CVE-2025-14149 affects Xpro Addons — 140+ Widgets for Elementor (WordPress). Stored Cross-Site Scripting via the Image Scroller widget box link attribute in all versions up to 1.4.24 due to insufficient input sanitization and output escaping. Exploitation requires authenticated access at contribu...

6.4CVSS5.7AI score0.00215EPSS
SaveExploits0References2
Cvelist
Cvelist•added 2026/02/27 6:43 a.m.•29 views

CVE-2025-14149 Xpro Addons — 140+ Widgets for Elementor <= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Scroller Widget box link

The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Scroller widget box link attribute in all versions up to, and including, 1.4.24 due to insufficient input sanitization and output escaping on user supplied...

6.4CVSS0.00215EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment•added 2026/02/27 6:43 a.m.•5 views

CVE-2025-14149 Xpro Addons — 140+ Widgets for Elementor <= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Scroller Widget box link

The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Scroller widget box link attribute in all versions up to, and including, 1.4.24 due to insufficient input sanitization and output escaping on user supplied...

6.4CVSS6AI score0.00215EPSS
SaveExploits0References2
CNNVD
CNNVD•added 2026/02/27 12:0 a.m.•14 views

WordPress plugin Xpro Addons — 140+ Widgets for Elementor 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed t...

6.4CVSS5.8AI score0.00215EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies•added 2026/02/27 12:0 a.m.•9 views

PT-2026-22307

The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Scroller widget box link attribute in all versions up to, and including, 1.4.24 due to insufficient input sanitization and output escaping on user supplied...

6.4CVSS6AI score0.00215EPSS
SaveExploits0References3
Patchstack
Patchstack•added 2026/02/26 11:33 p.m.•9 views

WordPress Xpro Addons - 140+ Widgets for Elementor plugin <= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Scroller Widget box link vulnerability

WordPress Xpro Addons - 140+ Widgets for Elementor plugin = 1.4.24 - Authenticated Contributor+ Stored Cross-Site Scripting via Image Scroller Widget box link vulnerability discovered by zer0gh0st in WordPress Plugin Xpro Elementor Addons versions = 1.4.24...

6.4CVSS5.4AI score0.00215EPSS
SaveExploits0References1Affected Software1
ATTACKERKB
ATTACKERKB•added 2026/02/26 9:56 p.m.•4 views

CVE-2026-27457

Weblate is a web based localization tool. Prior to version 5.16.1, the REST API's AddonViewSet weblate/api/views.py, line 2831 uses queryset = Addon.objects.all without overriding getqueryset to scope results by user permissions. This allows any authenticated user or anonymous users if REQUIRELOG...

4.3CVSS5.8AI score0.00303EPSS
SaveExploits0References7Affected Software1
OSV
OSV•added 2026/02/26 9:56 p.m.•9 views

CVE-2026-27457 Weblate: Missing access control for the AddonViewSet API exposes all addon configurations

Weblate is a web based localization tool. Prior to version 5.16.1, the REST API's AddonViewSet weblate/api/views.py, line 2831 uses queryset = Addon.objects.all without overriding getqueryset to scope results by user permissions. This allows any authenticated user or anonymous users if REQUIRELOG...

4.3CVSS5.9AI score
SaveExploits0References8
Vulnrichment
Vulnrichment•added 2026/02/26 9:56 p.m.•6 views

CVE-2026-27457 Weblate: Missing access control for the AddonViewSet API exposes all addon configurations

Weblate is a web based localization tool. Prior to version 5.16.1, the REST API's AddonViewSet weblate/api/views.py, line 2831 uses queryset = Addon.objects.all without overriding getqueryset to scope results by user permissions. This allows any authenticated user or anonymous users if REQUIRELOG...

4.3CVSS5.9AI score0.00303EPSS
SaveExploits0References6
Rows per page
Query Builder