488 matches found
WordPress Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons plugin <= 8.3.15 - Unauthenticated SMTP Header Injection vulnerability
Unauthenticated SMTP Header Injection vulnerability discovered by Drew Webber mcdruid in WordPress Plugin Element Pack Elementor Addons versions = 8.3.15...
CVE-2026-0673: Improper Neutralization of CRLF Sequences
The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 8.3.15 via the elementpackcontactform AJAX action. This is due to insufficient sanitization of newline characters in user-supplied input that gets concatenated...
CVE-2026-65502: Authentication Bypass by Spoofing
Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons = 8.7.13 versions...
CVE-2026-14817
The Element Pack Addons for Elementor WordPress plugin before 8.7.13 does not sanitize option values passed through certain data attributes before a bundled front-end library re-parses and renders them in the browser, allowing users with contributor-level access or higher to inject arbitrary...
WordPress Element Pack Addons for Elementor plugin < 8.7.13 - Contributor+ DOM-Based Stored XSS vulnerability
Contributor+ DOM-Based Stored XSS vulnerability discovered by Pierre Rudloff in WordPress Plugin Element Pack Elementor Addons versions 8.7.13...
CVE-2026-14817
The Element Pack Addons for Elementor WordPress plugin, versions before 8.7.13 , is vulnerable to a DOM-based stored XSS flaw. The root cause is a failure to sanitize option values passed through certain data attributes before a bundled front-end library re-parses and renders them in the browser....
CVE-2026-14817
The Element Pack Addons for Elementor WordPress plugin before 8.7.13 does not sanitize option values passed through certain data attributes before a bundled front-end library re-parses and renders them in the browser, allowing users with contributor-level access or higher to inject arbitrary...
CVE-2026-14817 Element Pack Elementor Addons < 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data Attributes
The Element Pack Addons for Elementor WordPress plugin before 8.7.13 does not sanitize option values passed through certain data attributes before a bundled front-end library re-parses and renders them in the browser, allowing users with contributor-level access or higher to inject arbitrary...
CVE-2026-14817 Element Pack Elementor Addons < 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data Attributes
The Element Pack Addons for Elementor WordPress plugin before 8.7.13 does not sanitize option values passed through certain data attributes before a bundled front-end library re-parses and renders them in the browser, allowing users with contributor-level access or higher to inject arbitrary...
PT-2026-67047
Name of the Vulnerable Software and Affected Versions Element Pack Addons for Elementor versions prior to 8.7.13 Description Insufficient sanitization of option values passed through data attributes allows users with contributor-level access or higher to perform a Cross-Site Scripting XSS attack...
CVE-2026-14817: Improper Neutralization of Input During Web Page Generation
The Element Pack Addons for Elementor WordPress plugin before 8.7.13 does not sanitize option values passed through certain data attributes before a bundled front-end library re-parses and renders them in the browser, allowing users with contributor-level access or higher to inject arbitrary...
WordPress Element Pack Elementor Addons plugin <= 8.7.13 - Captcha Bypass vulnerability
Captcha Bypass vulnerability discovered by johska in WordPress Plugin Element Pack Elementor Addons versions = 8.7.13...
EUVD-2026-37591
Contributor Local File Inclusion in Element Pack Pro = 9.0.6 versions...
CVE-2026-40721
Contributor Local File Inclusion in Element Pack Pro = 9.0.6 versions...
CVE-2026-40721 WordPress Element Pack Pro plugin <= 9.0.6 - Local File Inclusion vulnerability
Contributor Local File Inclusion in Element Pack Pro = 9.0.6 versions...
CVE-2026-40721 WordPress Element Pack Pro plugin <= 9.0.6 - Local File Inclusion vulnerability
Contributor Local File Inclusion in Element Pack Pro = 9.0.6 versions...
CVE-2026-40721
CVE-2026-40721 affects WordPress Element Pack Pro plugin, <= 9.0.6, with a Local File Inclusion vulnerability. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) yields a base score of 7.5 (HIGH). Exploitation is reported as network-based with high attack complexity and requires no user...
CVE-2026-40721: Improper Control of Filename for Include/Require Statement in PHP Program
Contributor Local File Inclusion in Element Pack Pro = 9.0.6 versions...
PT-2026-50311
Contributor Local File Inclusion in Element Pack Pro = 9.0.6 versions...
CVE-2026-4655
The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SVG Image Widget in versions up to and including 8.4.2. This is due to insufficient input sanitization and output escaping on SVG content fetched from remote URLs in the rendersvg...