9357 matches found
WordPress King Addons for Elementor plugin 51.1.56-51.1.80 - Author+ Missing Authorization vulnerability
Author+ Missing Authorization vulnerability discovered by Artus KG in WordPress Plugin King Addons for Elementor versions 51.1.56-51.1.80...
EUVD-2026-82661
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when importing template content into a page, allowing users with contributor-level access and above to overwrite the Elementor content of arbitrary posts and pages, including those...
CVE-2026-84903 King Addons for Elementor < 51.1.81 - Contributor+ Private Post Content Disclosure via kng_maintenance_page Shortcode
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password check before rendering the content of a user-supplied post, allowing users with Contributor-level access and above to read the content of private, draft, pending, and...
CVE-2026-84903
The King Addons for Elementor WordPress plugin, in versions before 51.1.81 , is vulnerable to unauthorized disclosure of private post content. The root cause is a lack of capability, post-status, or password checks when rendering content from a user-supplied post via the kng_maintenance_page shor...
EUVD-2026-82662
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password check before rendering the content of a user-supplied post, allowing users with Contributor-level access and above to read the content of private, draft, pending, and...
CVE-2026-85410: Missing Authorization
The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.2. This is due to the plugin not properly verifying that a user is...
PT-2026-95235
Name of the Vulnerable Software and Affected Versions King Addons for Elementor versions prior to 51.1.81 Description The plugin fails to perform capability, post-status, or password checks before rendering the content of a user-supplied post. This allows users with Contributor-level access and...
CVE-2026-84903: Exposure of Sensitive Information to an Unauthorized Actor
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password check before rendering the content of a user-supplied post, allowing users with Contributor-level access and above to read the content of private, draft, pending, and...
CVE-2026-84904: Missing Authorization
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownership of the targeted object, allowing...
PT-2026-95299
Name of the Vulnerable Software and Affected Versions Qi Addons For Elementor versions prior to 1.12 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when the Table of Contents widget is placed o...
CVE-2026-92249: Improper Neutralization of Input During Web Page Generation
The Qi Addons For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 1.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary we...
PT-2026-95334
Name of the Vulnerable Software and Affected Versions Master Addons for Elementor versions prior to 3.2.3 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with contributor-level acce...
PT-2026-95234
Name of the Vulnerable Software and Affected Versions King Addons for Elementor versions prior to 51.1.81 Description An issue exists where the software fails to perform an object-level authorization check during the import of template content into a page. This allows users with contributor-level...
CVE-2026-84902: Improper Neutralization of Input During Web Page Generation
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when importing template content into a page, allowing users with contributor-level access and above to overwrite the Elementor content of arbitrary posts and pages, including those...
PT-2026-95236
Name of the Vulnerable Software and Affected Versions King Addons for Elementor versions prior to 51.1.81 Description The plugin fails to perform per-object authorization checks for image-optimization actions. It relies on a coarse capability shared by lower-privileged users and does not verify...
CVE-2026-66626
Editor SQL Injection in SKT Addons for Elementor = 4.0 versions...
CVE-2026-66575
Unauthenticated Insecure Direct Object References IDOR in King Addons for Elementor = 51.1.81 versions...
CVE-2026-66574
Contributor Cross Site Scripting XSS in Element Pack Elementor Addons = 8.8.3 versions...