WordPress X Addons for Elementor plugin <= 1.0.23 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Abu Hurayra in WordPress Plugin X Addons for Elementor versions = 1.0.23...

CVE-2026-21876

creationtimestamp| type| source ---|---|--- 2026-01-07 15:00:13+00:00| published-proof-of-concept| Telegram/8x5IQVKl8yNMPOO1jEKzXeeCkVbSWNHK9QgypiDD-W4b3o 2026-01-07 21:00:04+00:00| published-proof-of-concept| Telegram/zaWOloGTmuxgYwScvhSZBdX4Ig42r1BJF11flVCmJ6M5QnQ 2026-01-07 21:09:46+00:00| see...

CVE-2026-22540

creationtimestamp| type| source ---|---|--- 2026-01-07 14:33:12+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115854304322324575 2026-01-07 16:04:37+00:00| published-proof-of-concept| Telegram/C5Pt7uloxKJDrqitQkO17NAOQQ9eE92f4ibyk5mNwogme0 2026-01-07 16:04:53+00:00| seen|...

CVE-2025-15479

creationtimestamp| type| source ---|---|--- 2026-01-07 14:29:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbtoikkrzi2q...

CVE-2025-13722

creationtimestamp| type| source ---|---|--- 2026-01-07 11:11:20+00:00| seen| https://gist.github.com/Darkcrai86/40ffb1ffe75add2294c250e432669d14...

CVE-2025-13520

creationtimestamp| type| source ---|---|--- 2026-01-07 09:51:09+00:00| seen| https://gist.github.com/Darkcrai86/000524f5a150e02d172b22b6d40593ea...

CVE-2025-1235

A low privileged attacker can set the date of the devices to the 19th of January 2038 an therefore exceed the 32-Bit time limit. This causes the date of the switch to be set back to January 1st, 1970...

CVE-2025-14867

creationtimestamp| type| source ---|---|--- 2026-01-07 08:23:05+00:00| seen| https://gist.github.com/Darkcrai86/0d448b4e0a6e01d4b558db801906cbf7...

RHSA-2026:0094

creationtimestamp| type| source ---|---|--- 2026-01-07 08:04:43+00:00| seen| https://gist.github.com/Darkcrai86/4b858c1057befd066dd851a635e9515f...

RHSA-2026:0139

creationtimestamp| type| source ---|---|--- 2026-01-07 08:00:04+00:00| seen| https://gist.github.com/Darkcrai86/8c147fe7398f0a30d342a66ef46b64f2...

CVE-2025-14524

creationtimestamp| type| source ---|---|--- 2026-01-07 06:21:41+00:00| seen| https://seclists.org/oss-sec/2026/q1/33 2026-01-07 07:51:28+00:00| seen| https://infosec.exchange/users/harrysintonen/statuses/115852724607348302 2026-01-07 08:11:17+00:00| seen|...

CVE-2026-0649

creationtimestamp| type| source ---|---|--- 2026-01-07 03:11:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbsinvln3d2e...

CVE-2025-47346

creationtimestamp| type| source ---|---|--- 2026-01-07 01:23:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbscmmkbxt2r 2026-01-07 07:09:03+00:00| seen| https://infosec.exchange/users/vuldb/statuses/115852557906939706 2026-01-07 14:06:51+00:00| seen|...

CVE-2025-47339

creationtimestamp| type| source ---|---|--- 2026-01-07 00:46:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbsakjreqp2r 2026-01-07 07:23:08+00:00| seen| https://infosec.exchange/users/vuldb/statuses/115852613280042209 2026-01-07 16:17:47+00:00| seen|...

CVE-2025-47333

creationtimestamp| type| source ---|---|--- 2026-01-07 00:44:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbsagosuyb2m...

CVE-2025-47369

creationtimestamp| type| source ---|---|--- 2026-01-07 00:39:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbsa4l4e3i2c...

PT-2026-1563

Name of the Vulnerable Software and Affected Versions MoneySpace plugin for WordPress versions prior to 2.13.9 Description The MoneySpace plugin for WordPress exhibits a sensitive information exposure issue. The plugin stores complete payment card details – including Primary Account Number PAN,...

CVE-2025-13744

creationtimestamp| type| source ---|---|--- 2026-01-06 21:59:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbrx6o6i6w2g 2026-01-06 22:03:31+00:00| seen| Telegram/-OW3sqnPqhIK1pTu69WvScZkwweKAPyIgGgW8wwOE8M61TM...

CVE-2025-40898

creationtimestamp| type| source ---|---|--- 2026-01-06 21:04:43+00:00| seen| Telegram/mvLvtEaiU3LejXoQfnx12bUjpBVkFYY20t1qsV7EynqZkMg...

CVE-2025-20781

creationtimestamp| type| source ---|---|--- 2026-01-06 20:12:52+00:00| seen| Telegram/jBZlDbE9sXNOGZiNfLnczbuckfSwrbzvFqPwUO0qENjWP0 2026-01-07 00:29:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mbs7lzsnwu2f 2026-01-07 00:30:53+00:00| seen|...