Elementor Pro <=4.2.1 - Unauthenticated Arbitrary File Upload via Form Handler

Elementor Pro plugin for WordPress in versions =4.2.1 is vulnerable to unauthenticated arbitrary file upload in the Forms module File Upload field. The validation and processfield methods iterate over submitted file entries with different early-exit logic for UPLOADERRNOFILE entries. When an...

cve-2026-32475-elementor-pro-lab

CVE-2026-32475 — Elementor Pro Forms: неаутентифицированная произвольная загрузка файлов → RCE A/B Docker-лаборатория, воспроизводящая CVE-2026-32475 CVSS 9.x, Patchstack; поле File Upload в формах Elementor Pro, затронуты версии ≤ 4.2.1, исправлено в 4.2.2 от 2026-08-19; сообщил Tin Pham / TF1T...

CVE-2026-32475

CVE-2026-32475 PoC: Elementor Pro Неаутентифицированная произвольная загрузка файлов с последующим RCE Неаутентифицированная произвольная загрузка файлов в Elementor Pro, приводящая к удалённому выполнению кода Proof-of-concept для CVE-2026-32475 — критической неаутентифицированной произвольной...

CVE-2026-32475

CVE-2026-32475 — Elementor Pro ≤ 4.2.1 Неаутентифицированная произвольная загрузка файлов → RCE PoC для CVE-2026-32475 CVSS 9.0 Critical, CWE-434: неаутентифицированная произвольная загрузка файлов в модуле Forms плагина Elementor Pro, приводящая к удалённому выполнению кода. Исправлено в Element...

CVE-2026-12526: Improper Authentication

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or superadmin. On a...

Exploit for CVE-2026-32475

CVE-2026-32475 — Elementor Pro ≤ 4.2.1 Unauthenticated Arbitra...

Exploit for CVE-2026-32475

CVE-2026-32475 — Elementor Pro Unauthenticated Arbitrary File...

Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code

Cybersecurity researchers have disclosed details of a critical flaw in the Elementor Pro WordPress plugin that, if successfully exploited, could lead to remote code execution. The vulnerability, tracked as CVE-2026-32475 , carries a CVSS score of 9.0 out of 10.0. It has been described as a case o...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Forms module. An attacker can execute arbitrary web scripts or inject HTML by submitting a crafted payload into a form with a rich text type field. Details Cross-site scripting or XSS is a code...

CVE-2022-26594

Multiple cross-site scripting XSS vulnerabilities in Liferay Portal 7.3.5 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allow remote attackers to inject arbitrary web script or HTML via a form field's help text to 1 Forms module's form builder, or 2 App Builder module's object form...

Cross-Site Scripting (XSS)

mezzanine is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper input sanitization in the "View Entries" feature within the Forms module, which allows an attacker to inject malicious scripts that execute in the context of another user's session...

CVE-2025-29573

Cross-Site Scripting XSS vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module...

GHSA-2544-HPCQ-6G27 Mezzanine CMS Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module...

Mezzanine CMS Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module...

PYSEC-2025-136

Cross-Site Scripting XSS vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module...

PYSEC-2025-136

Cross-Site Scripting XSS vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module...

CVE-2025-29573

Cross-Site Scripting XSS vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module...

CVE-2025-29573

Cross-Site Scripting XSS vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module...

CVE-2025-29573

Cross-Site Scripting XSS vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module...

CVE-2025-29573

Cross-Site Scripting XSS vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module...