CVE-2025-48295

CVE-2025-48295 concerns WordPress plugin hashthemes Easy Elementor Addons (versions up to 2.2.5). The vulnerability is a stored Cross-Site Scripting (XSS) flaw caused by improper input neutralization during web page generation, as reported by multiple sources. It is rated Medium (CVSS v3.1: 6.5) ...

CVE-2025-48295 WordPress Easy Elementor Addons plugin <= 2.2.5 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in hashthemes Easy Elementor Addons allows Stored XSS. This issue affects Easy Elementor Addons: from n/a through 2.2.5...

CVE-2025-48295 WordPress Easy Elementor Addons plugin <= 2.2.5 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows Stored XSS.This issue affects Easy Elementor Addons: from n/a through = 2.2.5...

CVE-2025-54037 WordPress News Kit Elementor Addons plugin <= 1.3.4 - Broken Access Control Vulnerability

Missing Authorization vulnerability in blazethemes News Kit Elementor Addons news-kit-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects News Kit Elementor Addons: from n/a through = 1.3.4...

CVE-2025-54037 WordPress News Kit Elementor Addons plugin <= 1.3.4 - Broken Access Control Vulnerability

Missing Authorization vulnerability in blazethemes News Kit Elementor Addons allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects News Kit Elementor Addons: from n/a through 1.3.4...

CVE-2025-5284 Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS extension in all versions up to, and including, 2.0.8.2 due to insufficient capability restriction, and...

CVE-2025-5284 Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS extension in all versions up to, and including, 2.0.8.2 due to insufficient capability restriction, and...

CVE-2025-5284

CVE-2025-5284 affects the WordPress plugin “Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations.” It describes a Stored Cross-Site Scripting (XSS) vulnerability via the Custom JS extension in all versions up to and including 2.0.8.2, caused by ...

PT-2025-29766 · WordPress · Responsive Addons For Elementor

Name of the Vulnerable Software and Affected Versions: CyberChimps Responsive Addons for Elementor versions through 1.7.3 Description: The software contains a cross-site scripting XSS issue due to improper neutralization of input during web page generation. This allows for stored XSS attacks...

WordPress plugin Easy Elementor Addons 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress plugin Master Addons 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2025-29759 · Blazethemes · News Kit Elementor Addons

Name of the Vulnerable Software and Affected Versions: blazethemes News Kit Elementor Addons versions through 1.3.4 Description: The software contains a missing authorization issue, allowing exploitation of incorrectly configured access control security levels. Recommendations: Update blazethemes...

WordPress plugin Responsive Addons for Elementor 跨站脚本漏洞

WordPress Responsive Addons for Elementor is a free plugin that provides 80+ Elementor widgets and 150+ templates with support for 250+ pre-built page modules. WordPress Responsive Addons for Elementor suffers from a cross-site scripting vulnerability that stems from improper input neutralization...

WordPress plugin News Kit Elementor Addons 安全漏洞

WordPress News Kit Elementor Addons is a visual page builder plugin designed for WordPress websites, mainly for creating news or blog sites. A lack of authorization vulnerability exists in WordPress News Kit Elementor Addons that stems from improperly configured access control, and no details of...

PT-2025-29729 · Elementor +1 · Elementor +1

Name of the Vulnerable Software and Affected Versions: hashthemes Easy Elementor Addons versions through 2.2.5 Description: The software contains a cross-site scripting issue due to improper neutralization of input during web page generation. This allows for stored cross-site scripting attacks...

PT-2025-29715 · WordPress · The Master Addons – Elementor Addons

Name of the Vulnerable Software and Affected Versions: Master Addons – Elementor Addons versions prior to 2.0.8.3 Description: The Master Addons – Elementor Addons plugin for WordPress is susceptible to Stored Cross-Site Scripting through the Custom JS extension. Insufficient capability...

Exploit for Unrestricted Upload of File with Dangerous Type in Royal-Elementor-Addons Royal_Elementor_Addons

CVE-2023-5360 Elementor File Upload Exploit The Royal Element...

DRUPAL-CONTRIB-2025-087

This module provides a format filter, which allows you to "disable" iframes e.g. remove their src attribute specified by the user. These elements will be enabled again, once the Cookies banner is accepted. The module doesn't sufficiently filter user-supplied content when their value might contain...

Drupal Cookies Addons module < - Authenticated Cross Site Scripting (XSS) vulnerability

Authenticated Cross Site Scripting XSS vulnerability discovered by Pierre Rudloff prudloff in WordPress Module Cookies Addons versions...

Cookies Addons - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-087

This module provides a format filter, which allows you to "disable" iframes e.g. remove their src attribute specified by the user. These elements will be enabled again, once the Cookies banner is accepted. The module doesn't sufficiently filter user-supplied content when their value might contain...