CVE-2025-8146

CVE-2025-8146 : Qi Addons For Elementor (WordPress) is vulnerable to Stored Cross-Site Scripting via the TypeOut Text widget in all versions up to and including 1.9.2, due to insufficient input sanitization and output escaping on user attributes. Exploitation requires authenticated access at cont...

CVE-2025-8146 Qi Addons for Elementor <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via TypeOut Text Widget

The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's TypeOut Text widget in all versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2025-31727 · WordPress · Medical Addon For Elementor

Name of the Vulnerable Software and Affected Versions: Medical Addon for Elementor plugin for WordPress versions prior to 1.6.4 Description: The Medical Addon for Elementor plugin for WordPress is susceptible to Stored Cross-Site Scripting via the Typewriter widget. Insufficient input sanitizatio...

CVE-2025-8068 HT Mega – Absolute Addons For Elementor <= 2.9.1 - Improper Authorization to Authenticated (Contributor+) Limited Administrator Actions

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to unauthorized modification and loss of data due to an improper capability check on the 'ajaxtrashtemplates' function in all versions up to, and including, 2.9.1. This makes it possible for authenticated attackers, wi...

CVE-2025-8068

The CVE-2025-8068 issue affects the WordPress plugin HT Mega – Absolute Addons For Elementor. A vulnerability in the ajax_trash_templates function arises from an improper capability check, making authenticated users with Contributor-level access and above able to delete arbitrary attachment files...

CVE-2025-8216

The Sky Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Multiple widgets in all versions up to, and including, 3.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker...

WordPress Sky Addons for Elementor plugin <= 3.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Multiple Widgets vulnerability discovered by zer0gh0st in WordPress Plugin Sky Addons for Elementor versions = 3.1.4...

CVE-2025-8216

The Sky Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Multiple widgets in all versions up to, and including, 3.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker...

CVE-2025-3075

The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'elementor-element' shortcode in all versions up to, and including, 3.29.0 due to insufficient input sanitization and output escaping on user supplied...

CVE-2025-3075

CVE-2025-3075 affects the WordPress plugin “Elementor Website Builder – More Than Just a Page Builder” up to version 3.29.0, via a Stored Cross-Site Scripting flaw in the elementor-element shortcode caused by insufficient input sanitization and output escaping of user attributes. Exploitation req...

CVE-2025-4566 Elementor <= 3.30.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Path Widget

The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-text DOM element attribute in Text Path widget in all versions up to, and including, 3.30.2 due to insufficient input sanitization and output escaping. This...

CVE-2025-3075 Elementor <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'elementor-element' shortcode in all versions up to, and including, 3.29.0 due to insufficient input sanitization and output escaping on user supplied...

CVE-2025-3075 Elementor <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'elementor-element' shortcode in all versions up to, and including, 3.29.0 due to insufficient input sanitization and output escaping on user supplied...

CVE-2025-4566 Elementor <= 3.30.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Path Widget

The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-text DOM element attribute in Text Path widget in all versions up to, and including, 3.30.2 due to insufficient input sanitization and output escaping. This...

WordPress Pixel Gallery Addons for Elementor plugin cross-site scripting vulnerability

WordPress Pixel Gallery Addons for Elementor plugin is a visual page builder plugin for WordPress platform, designed for Elementor, mainly used to create responsive image/video display features. The WordPress Pixel Gallery Addons for Elementor plugin suffers from a cross-site scripting...

WordPress Responsive Addons for Elementor Cross-Site Scripting Vulnerability

WordPress Responsive Addons for Elementor is a free plugin that provides 80+ Elementor widgets and 150+ templates with support for 250+ pre-built page modules. WordPress Responsive Addons for Elementor suffers from a cross-site scripting vulnerability that stems from improper input neutralization...

WordPress JetBlocks For Elementor Cross-Site Scripting Vulnerability

WordPress JetBlocks For Elementor is an enhancement plugin designed specifically for Elementor to extend the functionality of your WordPress website. WordPress JetBlocks For Elementor suffers from a cross-site scripting vulnerability that stems from improper input neutralization, which can be...

WordPress plugin Pixel Gallery Addons for Elementor 跨站脚本漏洞

WordPress Pixel Gallery Addons for Elementor plugin is a visual page builder plugin for WordPress platform, designed for Elementor, mainly used to create responsive image/video display features. The WordPress Pixel Gallery Addons for Elementor plugin suffers from a cross-site scripting...

WordPress Pixel Gallery Addons for Elementor plugin <= 1.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zer0gh0st in WordPress Plugin Pixel Gallery Addons for Elementor versions = 1.6.7...

WordPress Theme Builder For Elementor plugin <= 1.2.3 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Theme Builder For Elementor versions = 1.2.3...