Elementor Pro <=4.2.1 - Unauthenticated Arbitrary File Upload via Form Handler

Elementor Pro plugin for WordPress in versions =4.2.1 is vulnerable to unauthenticated arbitrary file upload in the Forms module File Upload field. The validation and processfield methods iterate over submitted file entries with different early-exit logic for UPLOADERRNOFILE entries. When an...

cve-2026-32475-elementor-pro-lab

CVE-2026-32475 — Elementor Pro Forms 인증되지 않은 임의 파일 업로드 → RCE CVE-2026-32475CVSS 9.x, Patchstack, Elementor Pro Forms File Upload 필드, 영향 ≤ 4.2.1, 2026-08-19에 4.2.2에서 수정, Tin Pham / TF1T 보고을 재현하는 A/B Docker 랩입니다. 인증되지 않았으며 사용자 상호작용이 필요 없습니다. 승인된 테스트/교육 전용입니다. 이 랩은 폐기 가능한 Docker 컨테이너에서 전적으로...

CVE-2026-32475

CVE-2026-32475 PoC: Elementor Pro 인증되지 않은 임의 파일 업로드를 통한 RCE Elementor Pro 사전 인증 임의 파일 업로드를 통한 원격 코드 실행 CVE-2026-32475에 대한 개념 증명PoC으로, Elementor Pro의 Forms 모듈에서 원격 코드 실행으로 이어지는 치명적인 인증되지 않은 임의 파일 업로드 취약점입니다. 이 PoC는 동일한 업로드 필드에 두 개의 파일 파트를 제출합니다 — 빈 첫 번째 항목빈 파일명, UPLOADERRNOFILE 트리거 뒤에 페이로드를 제출합니다...

CVE-2026-32475

CVE-2026-32475 — Elementor Pro ≤ 4.2.1 인증되지 않은 임의 파일 업로드 → RCE CVE-2026-32475CVSS 9.0 Critical, CWE-434에 대한 PoC: Elementor Pro Forms 모듈의 인증되지 않은 임의 파일 업로드로 원격 코드 실행으로 이어집니다. Elementor Pro 4.2.22026-08-19에서 수정되었습니다. Patchstack Bug Bounty 프로그램을 통해 Tin PhamTF1T이 보고했습니다. ███████╗ █████╗ ██╗ ██╗ ███╗...

CVE-2026-12526: Improper Authentication

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or superadmin. On a...

Exploit for CVE-2026-32475

CVE-2026-32475 — Elementor Pro ≤ 4.2.1 Unauthenticated Arbitra...

Exploit for CVE-2026-32475

CVE-2026-32475 — Elementor Pro Unauthenticated Arbitrary File...

Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code

Cybersecurity researchers have disclosed details of a critical flaw in the Elementor Pro WordPress plugin that, if successfully exploited, could lead to remote code execution. The vulnerability, tracked as CVE-2026-32475 , carries a CVSS score of 9.0 out of 10.0. It has been described as a case o...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Forms module. An attacker can execute arbitrary web scripts or inject HTML by submitting a crafted payload into a form with a rich text type field. Details Cross-site scripting or XSS is a code...

CVE-2022-26594

Multiple cross-site scripting XSS vulnerabilities in Liferay Portal 7.3.5 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allow remote attackers to inject arbitrary web script or HTML via a form field's help text to 1 Forms module's form builder, or 2 App Builder module's object form...

Cross-Site Scripting (XSS)

mezzanine is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper input sanitization in the "View Entries" feature within the Forms module, which allows an attacker to inject malicious scripts that execute in the context of another user's session...

CVE-2025-29573

Cross-Site Scripting XSS vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module...

GHSA-2544-HPCQ-6G27 Mezzanine CMS Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module...

Mezzanine CMS Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module...

PYSEC-2025-136

Cross-Site Scripting XSS vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module...

PYSEC-2025-136

Cross-Site Scripting XSS vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module...

CVE-2025-29573

Cross-Site Scripting XSS vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module...

CVE-2025-29573

Cross-Site Scripting XSS vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module...

CVE-2025-29573

Cross-Site Scripting XSS vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module...

CVE-2025-29573

Cross-Site Scripting XSS vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module...