1761 matches found
CVE-2026-17123
The CVE describe a Server-Side Request Forgery in the Royal Elementor Addons WordPress plugin (versions ≤ 1.7.1064). The Form Builder widget’s webhook_url setting persists attacker-controlled URLs into wpr_webhook_url_{widget_id} on each render. The wpr_form_builder_webhook AJAX handler, usable b...
CVE-2026-17123 Royal Addons for Elementor <= 1.7.1064 - Authenticated (Contributor+) Server-Side Request Forgery via Form Builder Widget 'webhook_url' Setting
The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhookurl' setting. The widget's render method persists the attacker-controlled URL into the wprwebhookurlwidgetid option on ever...
EUVD-2026-59863
The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhookurl' setting. The widget's render method persists the attacker-controlled URL into the wprwebhookurlwidgetid option on ever...
PT-2026-73098
The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhook url' setting. The widget's render method persists the attacker-controlled URL into the wpr webhook url widget id option on...
WordPress Royal Elementor Addons plugin < 1.7.1065 - Contributor+ Stored XSS via Icon Box Widget vulnerability
Contributor+ Stored XSS via Icon Box Widget vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Royal Elementor Addons versions 1.7.1065...
CVE-2026-19217 Royal Elementor Addons < 1.7.1065 - Contributor+ Stored XSS via Icon Box Widget
The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...
CVE-2026-19217
CVE-2026-19217 affects the Royal Addons for Elementor WordPress plugin (before version 1.7.1065). The vulnerability arises from improper validation of a widget setting used to construct an HTML tag, enabling Stored Cross-Site Scripting (XSS) by users with the Contributor role or higher. Impact is...
CVE-2026-65502
Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons = 8.7.13 versions...
CVE-2026-25403
Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons = 3.0.5 versions...
CVE-2026-65502
CVE-2026-65502 applies to the WordPress Element Pack Elementor Addons plugin (versions
CVE-2026-65502 WordPress Element Pack Elementor Addons plugin <= 8.7.13 - Captcha Bypass vulnerability
Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons = 8.7.13 versions...
EUVD-2026-53961
Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons = 8.7.13 versions...
EUVD-2026-53938
Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons = 3.0.5 versions...
CVE-2026-25403
Affected software: WordPress plugin “Ultimate Store Kit Elementor Addons”
CVE-2026-25403 WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons = 3.0.5 versions...
CVE-2026-12231
CVE-2026-12231 affects the WordPress plugin Exclusive Addons for Elementor . The vulnerability is a Stored Cross-Site Scripting via the exad_infobox_image parameter, present in all versions up to 2.7.9.8, due to insufficient input sanitization and output escaping. Exploitation requires authentica...
WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Bao - BlueRock in WordPress Plugin Ultimate Store Kit Elementor Addons versions = 3.0.5...
CVE-2026-65503
Contributor Cross Site Scripting XSS in Ultimate Store Kit Elementor Addons = 3.0.5 versions...