essential-addons-for-elementor-xss-poc

🔍 Essential Addons for Elementor XSS Vulnerability Detector 🚨 Critical Information This tool is for security research and patching purposes only. Do not use it to harm sites. If you find vulnerable sites, report them responsibly to site owners so they can update immediately. ⚠️ Vulnerability...

CVE-2026-115950

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Smart Widgets Better Post & Filter Widgets for Elementor better-post-filter-widgets-for-elementor allows Stored XSS.This issue affects Better Post & Filter Widgets for Elementor: from n/a throug...

CVE-2026-114707

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.5...

EUVD-2026-109729

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.5...

CVE-2026-114707 WordPress JetElements For Elementor plugin <= 2.9.2.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.5...

CVE-2026-114707

The WordPress JetElements For Elementor plugin (versions up to and including 2.9.2.5 ) is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability. This issue is caused by the improper neutralization of input during web page generation within the jet-elements component. An attacker could p...

WordPress JetElements For Elementor plugin <= 2.9.2.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin JetElements For Elementor versions = 2.9.2.5...

CVE-2026-115950 WordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Smart Widgets Better Post & Filter Widgets for Elementor better-post-filter-widgets-for-elementor allows Stored XSS.This issue affects Better Post & Filter Widgets for Elementor: from n/a throug...

EUVD-2026-109724

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Smart Widgets Better Post & Filter Widgets for Elementor better-post-filter-widgets-for-elementor allows Stored XSS.This issue affects Better Post & Filter Widgets for Elementor: from n/a throug...

CVE-2026-115950

The Better Post & Filter Widgets for Elementor plugin for WordPress (versions up to and including 1.9.1 ) is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability. This issue stems from the Improper Neutralization of Input During Web Page Generation within the better-post-filter-widgets...

WordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Peter Tang in WordPress Plugin Better Post & Filter Widgets for Elementor versions = 1.9.1...

CVE-2026-115949

Missing Authorization vulnerability in WP Smart Widgets Better Post & Filter Widgets for Elementor better-post-filter-widgets-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Post & Filter Widgets for Elementor: from n/a through 1.9.1...

EUVD-2026-109719

Missing Authorization vulnerability in WP Smart Widgets Better Post & Filter Widgets for Elementor better-post-filter-widgets-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Post & Filter Widgets for Elementor: from n/a through 1.9.1...

CVE-2026-115949

The WP Smart Widgets Better Post & Filter Widgets for Elementor plugin (versions up to and including 1.9.1 ) is susceptible to a Missing Authorization vulnerability. This security flaw allows for the exploitation of Incorrectly Configured Access Control Security Levels , potentially leading to un...

CVE-2026-115949 WordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP Smart Widgets Better Post & Filter Widgets for Elementor better-post-filter-widgets-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Post & Filter Widgets for Elementor: from n/a through 1.9.1...

WordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Oly Hossen in WordPress Plugin Better Post & Filter Widgets for Elementor versions = 1.9.1...

CVE-2025-30911

Exploit for CVE-2025-30911 – WordPress RomethemeKit = 1.5.4 This script exploits a critical vulnerability in the RomethemeKit For Elementor WordPress plugin = v1.5.4 that allows authenticated arbitrary plugin installation and activation , potentially leading to Remote Code Execution RCE. 🛠️...

CVE-2025-6325_CVE-2025-6327

CVE-2025-6325 + CVE-2025-6327 King Addons for Elementor — Dual Exploit PoC Research and validation tool for King Addons for Elementor For authorized security testing, vulnerability research, and controlled lab environments only. Overview This project provides a dual-purpose PoC for validating the...

WordPress The Plus Addons for Elementor <4.1.12 - Cross-Site Scripting

WordPress The Plus Addons for Elementor plugin before 4.1.12 is susceptible to cross-site scripting. The plugin does not properly sanitize some of its fields in the heplusmorepost AJAX action, which is exploitable by both unauthenticated and authenticated users. An attacker can inject arbitrary...

CVE-2026-115183

The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities in it, allowing users with the Contributor role and above to embed live HTML forms, including password fields that submit to an external host, into posts wher...