CVE-2026-65489: Missing Authorization

Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2...

PT-2026-63924

Unauthenticated Sensitive Data Exposure in Ultimate Store Kit Elementor Addons = 3.0.5 versions...

PT-2026-63910

Unauthenticated Broken Access Control in LA-Studio Element Kit for Elementor = 1.6.2 versions...

CVE-2026-65534: Improper Neutralization of Input During Web Page Generation

Author Cross Site Scripting XSS in Custom links in Elementor Image Carousel = 1.1.1 versions...

PT-2026-63945

Author Cross Site Scripting XSS in Custom links in Elementor Image Carousel = 1.1.1 versions...

PT-2026-63887

Contributor Cross Site Scripting XSS in JetElements For Elementor = 2.9.1.1 versions...

CVE-2026-65465: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in JetElements For Elementor = 2.9.1.1 versions...

PT-2026-63909

Unauthenticated Cross Site Request Forgery CSRF in LA-Studio Element Kit for Elementor = 1.6.2 versions...

CVE-2026-65503: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Ultimate Store Kit Elementor Addons = 3.0.5 versions...

CVE-2026-65482: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows DOM-Based XSS.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.3...

PT-2026-63923

Contributor Cross Site Scripting XSS in Ultimate Store Kit Elementor Addons = 3.0.5 versions...

WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Bao - BlueRock in WordPress Plugin Ultimate Store Kit Elementor Addons versions = 3.0.5...

WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin Ultimate Store Kit Elementor Addons versions = 3.0.5...

WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Steven Julian in WordPress Plugin LA-Studio Element Kit for Elementor versions = 1.6.2...

WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability

Cross Site Request Forgery CSRF to Stored XSS vulnerability discovered by Steven Julian in WordPress Plugin LA-Studio Element Kit for Elementor versions = 1.6.2...

WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Abu Hurayra in WordPress Plugin LA-Studio Element Kit for Elementor versions = 1.6.2...

WordPress JetElements For Elementor plugin <= 2.9.1.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin JetElements For Elementor versions = 2.9.1.1...

CVE-2026-15787

The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-15787 Ultimate Addons for Elementor <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes

The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-15787

The CVE concerns The Ultimate Addons for Elementor (WordPress) up to version 2.9.1, where a Stored XSS exists in the Navigation Menu Widget via data-toggle-icon/data-close-icon attributes. The root cause is insufficient input sanitization and output escaping; wp_kses_post is applied on save for u...