CVE-2025-12828 Ultra Addons Lite for Elementor <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Type Out Widget

The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Type Out widget in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

EUVD-2025-211026

The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Type Out widget in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

CVE-2022-29455

CVE-2022-29455 Wordpress Vulnerability - XSS Cross-Site Scripting Vulnerability Location https://add your target here/wp-content/plugins/elementor/assets/js/frontend.min.js Vulnerable Version = 3.5.5 versions Proof of Concept Exploit https://add your target...

CVE-2026-100180

The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 3.2.19 due to insufficient input sanitization and output escaping. This makes it possibl...

CVE-2026-100180

The Jeg Kit for Elementor WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 3.2.19 . The root cause is insufficient input sanitization and output escaping within the comment functionality. This allows unauthenticated attackers to inject arbitrary ...

CVE-2026-100180 Jeg Kit for Elementor <= 3.2.19 - Unauthenticated Stored Cross-Site Scripting via Comment

The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 3.2.19 due to insufficient input sanitization and output escaping. This makes it possibl...

EUVD-2026-91877

The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 3.2.19 due to insufficient input sanitization and output escaping. This makes it possibl...

CVE-2023-3124

CVE-2023-3124 CVE-2023-3124 Proof of Concept This is a proof of concept PoC exploit for CVE-2023-3124, a vulnerability in WordPress Elementor Pro plugin. Description: The Elementor Pro plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the...

PT-2026-104523

Name of the Vulnerable Software and Affected Versions Unlimited Elements for Elementor WordPress plugin versions prior to 2.0.21 Description Insufficient sanitization of file paths within uploaded archives allows authenticated users with access to the asset-management feature to write arbitrary...

CVE-2026-100180: Improper Neutralization of Input During Web Page Generation

The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 3.2.19 due to insufficient input sanitization and output escaping. This makes it possibl...

PT-2026-104585

Name of the Vulnerable Software and Affected Versions Unlimited Elements For Elementor Free Widgets, Addons, Templates versions prior to 2.0.21 Description An issue involving improper neutralization of input during web page generation allows for Reflected Cross-site Scripting XSS, a technique whe...

CVE-2026-103342: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor Free...

PT-2026-104481

Name of the Vulnerable Software and Affected Versions Jeg Kit for Elementor versions prior to 3.2.20 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping within the comment functionality. This allows unauthenticated attackers to inject arbitrar...

CVE-2026-85015: Improper Limitation of a Pathname to a Restricted Directory

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature Administrators by default, or Editors when a non-default Unlimited Elements fo...

PT-2026-104524

Name of the Vulnerable Software and Affected Versions Unlimited Elements for Elementor WordPress plugin versions prior to 2.0.21 Description An issue exists where search values are not correctly handled before rewriting a prepared SQL statement. This allows unauthenticated users to perform SQL...

PT-2026-104541

Name of the Vulnerable Software and Affected Versions Responsive Plus – Elementor Templates & Starter Sites versions prior to 3.5.4 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping within shortcode attributes. Authenticated attackers with...

PT-2026-104532

Name of the Vulnerable Software and Affected Versions Unlimited Elements for Elementor versions prior to 2.0.21 Description Insufficient sanitization and escaping of a parameter used in a SQL statement allows authenticated users to perform blind SQL injection attacks. This flaw enables the...

CVE-2026-15795: Improper Neutralization of Input During Web Page Generation

The Responsive Plus – Elementor Templates & Starter Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-92923: Improper Neutralization of Special Elements used in an SQL Command

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise and escape a parameter before using it in a SQL statement, allowing users with a role as low as subscriber to perform blind SQL injection attacks and read arbitrary data from the database. Version 2.0.18 removed...

CVE-2025-12828: Improper Neutralization of Input During Web Page Generation

The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Type Out widget in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...