PT-2026-94261

Name of the Vulnerable Software and Affected Versions Element Pack Elementor Addons versions prior to 8.8.4 Description Cross Site Scripting XSS allows an attacker with contributor-level permissions to execute malicious scripts in the browser of other users. Recommendations Update Element Pack...

PT-2026-94262

Unauthenticated Insecure Direct Object References IDOR in King Addons for Elementor = 51.1.81 versions...

PT-2026-94263

Contributor Cross Site Scripting XSS in JetBlocks For Elementor = 1.5.2 versions...

PT-2026-94180

Name of the Vulnerable Software and Affected Versions Master Addons for Elementor versions prior to 3.1.9 Description The plugin fails to perform an authorization check on the AJAX action used to deactivate Popup Builder popups. It relies solely on a nonce a number used once to prevent replay...

CVE-2026-66579: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in JetElements For Elementor = 2.9.2.1 versions...

CVE-2026-66576: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in JetBlocks For Elementor = 1.5.2 versions...

CVE-2026-66575: Authorization Bypass Through User-Controlled Key

Unauthenticated Insecure Direct Object References IDOR in King Addons for Elementor = 51.1.81 versions...

CVE-2026-66574: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Element Pack Elementor Addons = 8.8.3 versions...

CVE-2026-91015: Missing Authorization

The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only on a nonce that is publicly output to every visitor, allowing unauthenticated attackers to permanently disable any popup...

CVE-2026-86788: Improper Neutralization of Input During Web Page Generation

The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in several of its widgets and blocks to a safe allowlist, allowing users with contributor-level access and above to store a crafted tag name that executes arbitra...

PT-2026-94268

Contributor Server Side Request Forgery SSRF in Unlimited Elements For Elementor Free Widgets, Addons, Templates = 2.0.19 versions...

PT-2026-94266

Name of the Vulnerable Software and Affected Versions JetElements For Elementor versions prior to 2.9.2.2 Description An issue exists that allows a user with contributor privileges to perform Cross Site Scripting XSS, a technique where malicious scripts are injected into trusted websites...

PT-2026-94166

Name of the Vulnerable Software and Affected Versions HT Mega Addons for Elementor versions prior to 3.2.6 Description Users with contributor-level access and above can store a crafted HTML tag name used to render section headlines in several widgets and blocks. Because the plugin does not restri...

CVE-2026-66626: Improper Neutralization of Special Elements used in an SQL Command

Editor SQL Injection in SKT Addons for Elementor = 4.0 versions...

CVE-2026-66608: Server-Side Request Forgery (SSRF)

Contributor Server Side Request Forgery SSRF in Unlimited Elements For Elementor Free Widgets, Addons, Templates = 2.0.19 versions...

WordPress Royal Addons for Elementor plugin < 1.7.1067 - Unauthenticated Stored HTML Injection in Form Notification Emails vulnerability

Unauthenticated Stored HTML Injection in Form Notification Emails vulnerability discovered by Brian Willows in WordPress Plugin Royal Elementor Addons versions 1.7.1067...

CVE-2026-13407

The Royal Elementor Addons WordPress plugin before 1.7.1067 does not properly sanitize and escape values submitted through its form widget before including them in the body of administrator notification emails, allowing unauthenticated attackers to inject arbitrary HTML into emails sent to the si...

CVE-2026-13407 Royal Elementor Addons < 1.7.1067 - Unauthenticated Stored HTML Injection in Form Notification Emails

The Royal Elementor Addons WordPress plugin before 1.7.1067 does not properly sanitize and escape values submitted through its form widget before including them in the body of administrator notification emails, allowing unauthenticated attackers to inject arbitrary HTML into emails sent to the si...

CVE-2026-13407

CVE-2026-13407 affects the Royal Elementor Addons WordPress plugin in versions before 1.7.1067 . The form widget does not properly sanitize and escape submitted values before including them in administrator notification emails, allowing unauthenticated attackers to inject arbitrary HTML into emai...

EUVD-2026-80217

The Royal Elementor Addons WordPress plugin before 1.7.1067 does not properly sanitize and escape values submitted through its form widget before including them in the body of administrator notification emails, allowing unauthenticated attackers to inject arbitrary HTML into emails sent to the si...