15729 matches found
EUVD-2026-81356
The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only on a nonce that is publicly output to every visitor, allowing unauthenticated attackers to permanently disable any popup...
CVE-2026-91015
The Master Addons for Elementor WordPress plugin (versions 3.0.0-3.1.8 ) is vulnerable to unauthenticated popup deactivation. The flaw exists because the plugin fails to perform proper authorization checks on the AJAX action used to deactivate its Popup Builder popups. Instead, the action relies ...
CVE-2026-91015 Master Addons for Elementor < 3.1.9 - Unauthenticated Popup Deactivation via jltma_popup_disable_expired
The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only on a nonce that is publicly output to every visitor, allowing unauthenticated attackers to permanently disable any popup...
WordPress Master Addons for Elementor plugin 3.0.0-3.1.8 - Unauthenticated Popup Deactivation vulnerability
Unauthenticated Popup Deactivation vulnerability discovered by JunHee CHO in WordPress Plugin Master Addons for Elementor versions 3.0.0-3.1.8...
CVE-2026-91015 Master Addons for Elementor < 3.1.9 - Unauthenticated Popup Deactivation via jltma_popup_disable_expired
The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only on a nonce that is publicly output to every visitor, allowing unauthenticated attackers to permanently disable any popup...
EUVD-2026-81342
The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in several of its widgets and blocks to a safe allowlist, allowing users with contributor-level access and above to store a crafted tag name that executes arbitra...
CVE-2026-86788 HT Mega 3.2.0 - 3.2.5 - Contributor+ Stored XSS via Section Headline Tag
The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in several of its widgets and blocks to a safe allowlist, allowing users with contributor-level access and above to store a crafted tag name that executes arbitra...
PT-2026-94274
Editor SQL Injection in SKT Addons for Elementor = 4.0 versions...
CVE-2026-66579: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in JetElements For Elementor = 2.9.2.1 versions...
CVE-2026-66608: Server-Side Request Forgery (SSRF)
Contributor Server Side Request Forgery SSRF in Unlimited Elements For Elementor Free Widgets, Addons, Templates = 2.0.19 versions...
PT-2026-94166
Name of the Vulnerable Software and Affected Versions HT Mega Addons for Elementor versions prior to 3.2.6 Description Users with contributor-level access and above can store a crafted HTML tag name used to render section headlines in several widgets and blocks. Because the plugin does not restri...
CVE-2026-86788: Improper Neutralization of Input During Web Page Generation
The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in several of its widgets and blocks to a safe allowlist, allowing users with contributor-level access and above to store a crafted tag name that executes arbitra...
CVE-2026-66574: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in Element Pack Elementor Addons = 8.8.3 versions...
PT-2026-94266
Name of the Vulnerable Software and Affected Versions JetElements For Elementor versions prior to 2.9.2.2 Description An issue exists that allows a user with contributor privileges to perform Cross Site Scripting XSS, a technique where malicious scripts are injected into trusted websites...
PT-2026-94268
Contributor Server Side Request Forgery SSRF in Unlimited Elements For Elementor Free Widgets, Addons, Templates = 2.0.19 versions...
PT-2026-94261
Name of the Vulnerable Software and Affected Versions Element Pack Elementor Addons versions prior to 8.8.4 Description Cross Site Scripting XSS allows an attacker with contributor-level permissions to execute malicious scripts in the browser of other users. Recommendations Update Element Pack...
CVE-2026-66575: Authorization Bypass Through User-Controlled Key
Unauthenticated Insecure Direct Object References IDOR in King Addons for Elementor = 51.1.81 versions...
PT-2026-94262
Unauthenticated Insecure Direct Object References IDOR in King Addons for Elementor = 51.1.81 versions...