The Plus Addons for Elementor Page Builder < 4.1.7 - Authentication Bypass

The Plus Addons for Elementor plugin before version 4.1.7 allowed attackers to bypass authentication, gain admin access, and create accounts with elevated roles, even when registration was disabled and the Login widget was inactive. id: CVE-2021-24175 info: name: The Plus Addons for Elementor Pag...

PT-2026-104615

Name of the Vulnerable Software and Affected Versions Unlimited Elements For Elementor versions prior to 2.0.21 Description Unlimited Elements for Elementor contains a blind SQL injection flaw. This issue allows unauthenticated remote attackers to extract arbitrary database records by failing to...

PT-2026-104613

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor Free...

CVE-2026-32475

🔴 CVE-2026-32475 — Elementor Pro Subida de Archivos Sin Restricciones → RCE Vulnerabilidad crítica de subida de archivos sin restricciones en Elementor Pro Potencialmente conducente a Ejecución Remota de Código RCE ⚠️ Resumen CVE-2026-32475 es una vulnerabilidad de seguridad crítica que afecta a...

CVE-2022-1329

CVE-2022-1329 🦠 Proyecto desarrollado por Agustín Sánchez Martín y Enrique Sánchez-Migallón Ochoa para la asignatura de Seguridad en Sistemas Informáticos impartida por Sebastián Reyes Ávila en la Escuela Superior de Informática de Ciudad Real. Este proyecto contiene la documentación y pasos...

WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.4.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by neurotx in WordPress Plugin ShopBuilder – Elementor WooCommerce Builder Addons versions = 3.4.1...

CVE-2026-103342

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor Free...

CVE-2026-103342 WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor Free...

CVE-2026-103342

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin is vulnerable to Reflected Cross-Site Scripting (XSS) due to the improper neutralization of input during web page generation. This vulnerability affects versions from n/a through 2.0.20 . While the specific ro...

EUVD-2026-92028

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor Free...

cve-2026-32475-elementor-pro-lab

CVE-2026-32475 — Elementor Pro Forms carga de archivos arbitraria sin autenticación → RCE Laboratorio A/B en Docker que reproduce CVE-2026-32475 CVSS 9.x, Patchstack; campo de carga de archivos de Elementor Pro Forms, afectado ≤ 4.2.1, corregido en 4.2.2 el 2026-08-19; reportado por Tin Pham /...

CVE-2023-5360-exploit-with-native-libraries

Royal Elementor Addons ≤ 1.3.78 – Carga Arbitraria de Archivos No Autenticada RCE 📌 Resumen Este repositorio contiene un exploit de prueba de concepto modificado para el plugin de WordPress Royal Elementor Addons and Templates versiones ≤ 1.3.78. La vulnerabilidad permite la carga arbitraria de...

CVE-2026-32475

CVE-2026-32475 PoC: Elementor Pro Subida Arbitraria de Archivos No Autenticada a RCE Subida Arbitraria de Archivos Pre-Autenticación en Elementor Pro que Conduce a Ejecución Remota de Código Prueba de concepto para CVE-2026-32475, una subida arbitraria de archivos no autenticada crítica en el...

CVE-2026-15795

The Responsive Plus – Elementor Templates & Starter Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-75028 WPCafe <= 3.0.18 - Authenticated (Contributor+) Local File Inclusion via 'food_menu_style' Elementor Widget Setting

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the template scope function. This makes it possible for authenticated attackers, with contributor-level access and...

CVE-2026-15795 Responsive Plus <= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Responsive Plus – Elementor Templates & Starter Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-15795

The Responsive Plus – Elementor Templates & Starter Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.5.3 . The root cause is insufficient input sanitization and output escaping within Shortcode Attributes . This flaw allows authen...

EUVD-2026-91953

The Responsive Plus – Elementor Templates & Starter Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-92923

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise and escape a parameter before using it in a SQL statement, allowing users with a role as low as subscriber to perform blind SQL injection attacks and read arbitrary data from the database. Version 2.0.18 removed...

CVE-2026-85015

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature Administrators by default, or Editors when a non-default Unlimited Elements fo...