WordPress Unlimited Elements for Elementor plugin < 2.0.21 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions 2.0.21...

CVE-2026-85016

The Unlimited Elements for Elementor WordPress plugin (versions before 2.0.21 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to escape an icon value before concatenating it into an HTML attribute within the shared widget-parameter processor . This flaw allows u...

EUVD-2026-91192

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter processor, allowing users with Contributor access who do not hold unfilteredhtml to store a payload that executes when th...

WordPress Royal Elementor Addons Plugin <= 1.3.78 - Arbitrary File Upload

Arbitrary File Upload vulnerability in WordPress Royal Elementor Addons Plugin. This could allow a malicious actor to upload any type of file to your website. This can include backdoors which are then executed to gain further access to your website. This vulnerability has been fixed in version...

PT-2026-104087

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter processor, allowing users with Contributor access who do not hold unfiltered html to store a payload that executes when t...

PT-2026-104114

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not check that a request to render widget output comes from a user allowed to make it, allowing users with a role as low as subscriber to have arbitrary WordPress shortcodes executed on the site. Version 2.0.18 removed the...

CVE-2026-18351

CVE-2026-18351 Herramienta de explotación masiva para CVE-2026-18351 — Carga Arbitraria de Archivos No Autenticada → RCE en Drag and Drop File Upload for Elementor Forms crédito johenlastgen | telegram @johenlastgen | canal @jlgnetworkredirect Características Sonda pasiva de vulnerabilidad sin...

CVE-2023-32243-Detection-and-Mitigation-in-WordPress

🔐 CVE-2023-32243 – WordPress 中的检测与缓解 📘 项目标题： Essential Addons for Elementor WordPress 插件中 CVE-2023-32243 的检测与缓解 🧠 摘要 本项目探索了 CVE-2023-32243 的利用与防御，这是一个影响 WordPress 中 "Essential Addons for Elementor" 插件（版本 5.4.0 至 5.7.1）的严重 权限提升漏洞 （CVSS 评分：9.8）。该漏洞允许未经身份验证的攻击者重置管理员密码，从而获得 WordPress 后台的完全访问权限。...

-CVE-2026-1657

CVE-2026-1657 Exploit de CVE-2026-1657: Subida de imagen no autenticada a través del endpoint AJAX 'epuploadfilemedia' USO python3 ./CVE-2026-1657.py https://site.com/ labrat.jpeg...

CVE-2025-8081-Elementor

CVE-2025-8081 - Vulnerabilidad de Lectura Arbitraria de Archivos en Elementor Una vulnerabilidad crítica de lectura arbitraria de archivos en el plugin de WordPress Elementor que permite a administradores autenticados leer cualquier archivo accesible por el servidor web, incluidos archivos de...

CVE-2026-2600-POC

CVE-2026-2600 ElementsKit Elementor Addons $item echo '' . $item'ekittabtitle' . ''; El editor de Elementor sanea la entrada en el lado del cliente, pero el endpoint de la API REST /wp-json/wp/v2/posts/id acepta el campo meta elementordata directamente y omite esa capa por completo. Un Contributo...

CVE-2026-32475-PoC

CVE-2026-32475 — Elementor Pro Subida de Archivos Arbitraria No Autenticada → RCE Prueba de concepto para CVE-2026-32475 CVSS 9.0: una vulnerabilidad de subida de archivos arbitraria no autenticada en el plugin de WordPress Elementor Pro ≤ 4.2.1 que conduce a la ejecución remota de código. |...

CVE-2025-30911

CVE-2025-30911 漏洞利用 – WordPress RomethemeKit = 1.5.4 该脚本利用 RomethemeKit For Elementor WordPress 插件（ = v1.5.4） 中的一个严重漏洞 ，该漏洞允许经过身份验证的任意插件安装与激活 ，最终可能导致远程代码执行（RCE） 。 🛠️ 漏洞概述 CVE 编号 ：CVE-2025-30911 插件 ：RomethemeKit For Elementor 受影响版本 ：= 1.5.4 漏洞类型 ：任意插件安装与激活 → RCE CWE ：CWE-94：代码生成控制不当 CVSS 评分 ：9.9（严重...

WP-CVE-2023-5360

WP-CVE-2023-5360 Royal Elementor Addons and Templates = 1.3.78 – 未经身份验证的任意文件上传 Python 2.7 买杯咖啡 : 比特币 $: 14nXhmRiQx5joCXFTdR8ydm3T8et7MFDXC 如何使用？ 安装 Python 2.7 在此下载 python file.py...

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.20...

CVE-2026-103064

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Wpmet ElementsKit Elementor addons Lite elementskit-lite allows Stored XSS.This issue affects ElementsKit Elementor addons Lite: from n/a through 4.0.6...

CVE-2026-103338

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor...

CVE-2026-103341

Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Unlimited Elements For Elementor Free Widgets,...

CVE-2026-102394

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through 6.8.4...

CVE-2026-103063

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Wpmet ElementsKit Elementor addons Lite elementskit-lite allows Stored XSS.This issue affects ElementsKit Elementor addons Lite: from n/a through 4.0.6...