CVE-2026-84750

The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of its form fields, and stores them at a predictable public path with the attacker-chosen extension intact, allowing unauthenticated users to upload arbitrary...

EUVD-2026-83502

The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of its form fields, and stores them at a predictable public path with the attacker-chosen extension intact, allowing unauthenticated users to upload arbitrary...

CVE-2026-84750 Ultimate Addons for Contact Form 7 3.2.4 - 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Field

The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of its form fields, and stores them at a predictable public path with the attacker-chosen extension intact, allowing unauthenticated users to upload arbitrary...

CVE-2026-84750

The Ultra Addons for Contact Form 7 WordPress plugin (versions 3.2.4-3.5.50 ) is vulnerable to an unauthenticated arbitrary file upload due to a lack of validation on file types and extensions in specific form fields. Attackers can upload files to a predictable public path with chosen extensions....

CVE-2026-84750 Ultimate Addons for Contact Form 7 3.2.4 - 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Field

The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of its form fields, and stores them at a predictable public path with the attacker-chosen extension intact, allowing unauthenticated users to upload arbitrary...

CVE-2026-1641: Server-Side Request Forgery (SSRF)

The Wow Elements Addons for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.11.2. This is due to the plugin passing user-controlled input from the 'Changelog File' setting directly to the wpremoteget function without adequate...

PT-2026-95755

Name of the Vulnerable Software and Affected Versions Ultra Addons for Contact Form 7 versions prior to 3.5.51 Description Unauthenticated users can upload arbitrary files because the plugin fails to validate file types or extensions in one of its form fields. Uploaded files are stored in a...

CVE-2026-84750: Unrestricted Upload of File with Dangerous Type

The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of its form fields, and stores them at a predictable public path with the attacker-chosen extension intact, allowing unauthenticated users to upload arbitrary...

PT-2026-95783

Name of the Vulnerable Software and Affected Versions Wow Elements Addons for Elementor versions prior to 1.11.3 Description This issue is a Server-Side Request Forgery, a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. Authenticated...

PT-2026-95784

Name of the Vulnerable Software and Affected Versions Ibtana – Ecommerce Product Addons versions prior to 0.4.7.8 Description Authenticated users with Subscriber-level access and above can perform unauthorized post meta modification. This is caused by a missing capability check on the 'iepa use g...

CVE-2026-1984: Missing Authorization

The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the 'iepausegteditor' AJAX action in all versions up to, and including, 0.4.7.7. This makes it possible for authenticated attackers, with...

WordPress Wow Elements Addons for Elementor plugin <= 1.11.2 - Authenticated (Contributor+) Server-Side Request Forgery vulnerability

Authenticated Contributor+ Server-Side Request Forgery vulnerability discovered by Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777, Waris Damkham in WordPress Plugin Wow Elements Addons for Elementor versions = 1.11.2...

meadmin-addons-doc (>=1.0.0, <=1.3.14) potentially affected by CVE-2026-84992 via md-editor-v3 (6.3.1)

md-editor-v3 NPM version 6.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on md-editor-v3 and may be impacted: - meadmin-addons-doc =1.0.0, =1.3.14 Source cves: CVE-2026-84992 Source advisory: OSV:GHSA-3RM2-H79C-8QW6...

WordPress Pixel Gallery Addons for Elementor plugin <= 2.1.14 - Cross-Site Scripting vulnerability

Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Pixel Gallery Addons for Elementor versions = 2.1.14...

WordPress Ultimate Store Kit plugin <= 3.0.7 - Cross-Site Scripting vulnerability

Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Ultimate Store Kit Elementor Addons versions = 3.0.7...

WordPress Element Pack Addons for Elementor plugin <= 8.7.14 - Cross-Site Scripting vulnerability

Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Element Pack Elementor Addons versions = 8.7.14...

WordPress Qi Addons For Elementor plugin <= 1.11 - Reflected DOM-Based Cross-Site Scripting vulnerability

Reflected DOM-Based Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin Qi Addons For Elementor versions = 1.11...

CVE-2026-85410

The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.2. This is due to the plugin not properly verifying that a user is...

EUVD-2026-82793

The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.2. This is due to the plugin not properly verifying that a user is...

CVE-2026-85410 Master Addons for Elementor <= 3.2.2 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification/Deletion via 'popup_id' Parameter

The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.2. This is due to the plugin not properly verifying that a user is...