Unlimited Elements for Elementor <= 1.5.93 - Cross Site Scripting

Unlimited Elements For Elementor Free Widgets, Addons, Templates versions up to 1.5.93 contain a reflected cross-site scripting caused by improper neutralization of input during web page generation, letting attackers execute malicious scripts in the victim's browser, exploit requires attacker to...

HT Mega – Absolute Addons for Elementor <= 2.2.0 - Missing Authorization to Privilege Escalation

The HT Mega plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.2.0. This is due to missing validation of the regrole parameter on the htmegaajaxregister function. This makes it possible for unauthenticated attackers to create administrator accounts. id...

The Plus Addons for Elementor Page Builder < 4.1.7 - Authentication Bypass

The Plus Addons for Elementor plugin before version 4.1.7 allowed attackers to bypass authentication, gain admin access, and create accounts with elevated roles, even when registration was disabled and the Login widget was inactive. id: CVE-2021-24175 info: name: The Plus Addons for Elementor Pag...

CVE-2023-47504-POC

CVE-2023-47504 POC Exploit for CVE-2023-47504. According to NIST, this vulnerability should allow unauthenticated users to access functionalities in the Elementor Website Builder Plugin. Based on my research into the vulnerability, and also judging by the URL from Patchstack that describes the...

CVE-2026-54866

Unauthenticated Cross Site Scripting XSS in Razorpay Payment Button Elementor Plugin = 1.2.8 versions...

EUVD-2026-112955

Unauthenticated Cross Site Scripting XSS in Razorpay Payment Button Elementor Plugin = 1.2.8 versions...

CVE-2026-54866

The Razorpay Payment Button Elementor Plugin for WordPress, in versions

CVE-2026-54866 WordPress Razorpay Payment Button Elementor Plugin plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Razorpay Payment Button Elementor Plugin = 1.2.8 versions...

CVE-2026-54866 WordPress Razorpay Payment Button Elementor Plugin plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Razorpay Payment Button Elementor Plugin = 1.2.8 versions...

PT-2026-132273

Unauthenticated Cross Site Scripting XSS in Razorpay Payment Button Elementor Plugin = 1.2.8 versions...

Razorpay Payment Button Elementor Plugin cross-site scripting vulnerability

The Razorpay Payment Button Elementor Plugin versions 1.2.8 and earlier contain a cross-site scripting vulnerability, which stems from unauthenticated cross-site scripting attacks...

CVE-2026-54866: Razorpay Razorpay Payment Button Elementor Plugin: Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button Elementor Plugin <= 1.2.8 versions.

Unauthenticated Cross Site Scripting XSS in Razorpay Payment Button Elementor Plugin = 1.2.8 versions...

WordPress Razorpay Payment Button Elementor Plugin plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Razorpay Payment Button Elementor Plugin versions = 1.2.8...

EUVD-2026-80190

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link setting before storing and using it in a JavaScript navigation call, allowing users with the contributor role and above to inject and store JavaScript that executes in the browse...

CVE-2026-18561 Unlimited Elements For Elementor <= 2.0.16 - Unauthenticated SQL Injection

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in...

WordPress Sina Extension for Elementor plugin 3.7.1-3.10.3 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Sina Extension for Elementor versions 3.7.1-3.10.3...

PT-2026-88763

The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'iq tree tree chart template' Widget Setting in all versions up to, and including, 3.1.11 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-84820 WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.17 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Unlimited Elements For Elementor Free Widgets, Addons, Templates = 2.0.17 versions...

EUVD-2026-70913

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and...

CVE-2026-85304

Unlimited Elements For Elementor (Free Widgets, Addons, Templates) , a WordPress plugin, has a Missing Authorization (broken access control) vulnerability in versions through 2.0.17 . The flaw allows exploitation of incorrectly configured access control security levels, resulting in low confident...