essential-addons-for-elementor-xss-poc

🔍 Essential Addons for Elementor XSS Vulnerability Detector 🚨 Critical Information This tool is for security research and patching purposes only. Do not use it to harm sites. If you find vulnerable sites, report them responsibly to site owners so they can update immediately. ⚠️ Vulnerability...

WordPress The Plus Addons for Elementor <4.1.12 - Cross-Site Scripting

WordPress The Plus Addons for Elementor plugin before 4.1.12 is susceptible to cross-site scripting. The plugin does not properly sanitize some of its fields in the heplusmorepost AJAX action, which is exploitable by both unauthenticated and authenticated users. An attacker can inject arbitrary...

CVE-2026-94168

The Premium Addons for Elementor WordPress plugin (versions

EUVD-2026-85473

Contributor Cross Site Scripting XSS in Premium Addons for Elementor = 4.11.105 versions...

CVE-2026-85006

The HappyAddons for Elementor WordPress plugin versions prior to 3.50.0 is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is a failure to escape an icon value on one of its button widgets before it is outputted inside an HTML attribute. This allows users with Contributor-l...

CVE-2026-85006 Happy Addons for Elementor < 3.50.0 - Contributor+ Stored XSS via Creative Button Widget

The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an icon value on one of its button widgets before outputting it inside an HTML attribute, allowing users with Contributor-level access and above to inject event-handler attributes that execute JavaScript in the browser o...

CVE-2025-6325_CVE-2025-6327

CVE-2025-6325 + CVE-2025-6327 King Addons for Elementor — PoC de Explotación Dual Herramienta de investigación y validación para King Addons for Elementor Solo para pruebas de seguridad autorizadas, investigación de vulnerabilidades y entornos de laboratorio controlados. Descripción General Este...

Exploit for CVE-2025-6325

CVE-2025-6325 + CVE-2025-6327 King Addons for Elementor —...

Exploit for CVE-2025-6325

CVE-2025-6325-CVE-2025-6327 CVE-20...

CVE-2026-1641

The Wow Elements Addons for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.11.2. This is due to the plugin passing user-controlled input from the 'Changelog File' setting directly to the wpremoteget function without adequate...

CVE-2026-1641 Wow Elements Addons for Elementor <= 1.11.2 - Authenticated (Contributor+) Server-Side Request Forgery via Changelog File Setting

The Wow Elements Addons for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.11.2. This is due to the plugin passing user-controlled input from the 'Changelog File' setting directly to the wpremoteget function without adequate...

CVE-2026-1641 Wow Elements Addons for Elementor <= 1.11.2 - Authenticated (Contributor+) Server-Side Request Forgery via Changelog File Setting

The Wow Elements Addons for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.11.2. This is due to the plugin passing user-controlled input from the 'Changelog File' setting directly to the wpremoteget function without adequate...

CVE-2026-1641

The Wow Elements Addons for Elementor plugin for WordPress is affected by a Server-Side Request Forgery (SSRF) vulnerability in all versions up to and including 1.11.2 . The root cause is the plugin passing user-controlled input from the 'Changelog File' setting directly to the wp_remote_get func...

EUVD-2026-83550

The Wow Elements Addons for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.11.2. This is due to the plugin passing user-controlled input from the 'Changelog File' setting directly to the wpremoteget function without adequate...

CVE-2026-1641: Server-Side Request Forgery (SSRF)

The Wow Elements Addons for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.11.2. This is due to the plugin passing user-controlled input from the 'Changelog File' setting directly to the wpremoteget function without adequate...

WordPress Pixel Gallery Addons for Elementor plugin <= 2.1.14 - Cross-Site Scripting vulnerability

Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Pixel Gallery Addons for Elementor versions = 2.1.14...

WordPress Element Pack Addons for Elementor plugin <= 8.7.14 - Cross-Site Scripting vulnerability

Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Element Pack Elementor Addons versions = 8.7.14...

WordPress Qi Addons For Elementor plugin <= 1.11 - Reflected DOM-Based Cross-Site Scripting vulnerability

Reflected DOM-Based Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin Qi Addons For Elementor versions = 1.11...

CVE-2026-85410

The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.2. This is due to the plugin not properly verifying that a user is...

CVE-2026-85410 Master Addons for Elementor <= 3.2.2 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification/Deletion via 'popup_id' Parameter

The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.2. This is due to the plugin not properly verifying that a user is...