EUVD-2026-48113

Contributor Cross Site Scripting XSS in Ultimate Store Kit Elementor Addons = 3.0.5 versions...

CVE-2026-65503

The CVE concerns WordPress plugin Ultimate Store Kit Elementor Addons versions

CVE-2026-65499

CVE-2026-65499 affects the WordPress plugin PeproDev Ultimate Invoice, version

EUVD-2026-48110

Unauthenticated Broken Access Control in PeproDev Ultimate Invoice = 2.2.6 versions...

CVE-2026-27372

The CVE concerns WordPress plugin PeproDev Ultimate Invoice (admin URL not needed) for affected versions

EUVD-2026-48153

Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice = 2.2.6 versions...

PT-2026-63924

Unauthenticated Sensitive Data Exposure in Ultimate Store Kit Elementor Addons = 3.0.5 versions...

PT-2026-63926

Unauthenticated Cross Site Scripting XSS in PeproDev Ultimate Invoice = 2.2.6 versions...

PT-2026-63923

Contributor Cross Site Scripting XSS in Ultimate Store Kit Elementor Addons = 3.0.5 versions...

CVE-2026-15787

The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-15787 Ultimate Addons for Elementor <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes

The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-15787

The CVE concerns The Ultimate Addons for Elementor (WordPress) up to version 2.9.1, where a Stored XSS exists in the Navigation Menu Widget via data-toggle-icon/data-close-icon attributes. The root cause is insufficient input sanitization and output escaping; wp_kses_post is applied on save for u...

EUVD-2026-47620

The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible...

PT-2026-63331

The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible...

EUVD-2025-210458

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.1 does not escape the value of the BEAF Slider widget's shortcode field before outputting it on the front end the value is passed through doshortcode, which echoes non-shortcode content verbatim, allowing users with...

EUVD-2026-43302

The Joomla extension Helix Ultimate is vulnerable to an unauthenticated stored XSS...

EUVD-2026-43303

The Joomla extension Helix Ultimate is vulnerable to an unauthenticated arbitrary file deletion...

CVE-2026-57829

Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Helix Ultimate 2.2.7 - The Joomla extension Helix Ultimate is vulnerable to an unauthenticated stored XSS...

CVE-2026-57830

Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate 2.2.7 - The Joomla extension Helix Ultimate is vulnerable to an unauthenticated arbitrary file deletion...

CVE-2026-57830

CVE-2026-57830 affects the Joomla extension Helix Ultimate (JoomShaper). The exposed vulnerability is unauthenticated, enabling arbitrary deletion of files (and recursive folder deletion) via the site-side path handling in the vulnerable media-related actions (delete-media, view-media). The root ...