CVE-2026-14596

The DynamicKit for Elementor WordPress plugin before 1.0.3 does not validate the host of a user-supplied URL used as the base of the password-reset link it emails, allowing unauthenticated attackers to send a target user a legitimately-formatted reset email whose link points to an...

CVE-2026-14596

The CVE concerns the DynamicKit for Elementor WordPress plugin prior to version 1.0.3. The vulnerability is: the plugin does not validate the host of a user-supplied URL used as the base for password-reset links sent via email. This enables an unauthenticated attacker to cause a target user to re...

EUVD-2026-51720

The DynamicKit for Elementor WordPress plugin before 1.0.3 does not validate the host of a user-supplied URL used as the base of the password-reset link it emails, allowing unauthenticated attackers to send a target user a legitimately-formatted reset email whose link points to an...