EUVD-2026-53946

Contributor Arbitrary File Download in Unlimited Elements For Elementor Free Widgets, Addons, Templates = 2.0.14 versions...

CVE-2026-25403 WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons = 3.0.5 versions...

CVE-2026-25403

Affected software: WordPress plugin “Ultimate Store Kit Elementor Addons”

CVE-2026-25403 WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons = 3.0.5 versions...

EUVD-2026-53938

Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons = 3.0.5 versions...

CVE-2026-0673 Element Pack Addons for Elementor <= 8.3.15 - Unauthenticated SMTP Header Injection

The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 8.3.15 via the elementpackcontactform AJAX action. This is due to insufficient sanitization of newline characters in user-supplied input that gets concatenated...

CVE-2026-0673 Element Pack Addons for Elementor <= 8.3.15 - Unauthenticated SMTP Header Injection

The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 8.3.15 via the elementpackcontactform AJAX action. This is due to insufficient sanitization of newline characters in user-supplied input that gets concatenated...

CVE-2026-0673

The CVE concerns the WordPress plugin Element Pack Addons for Elementor (affecting versions up to 8.3.15). It describes an email header injection vulnerability in the element_pack_contact_form AJAX action caused by insufficient sanitization of newline characters in user-provided input, allowing u...

WordPress King Addons for Elementor plugin < 51.1.76 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by V1T in WordPress Plugin King Addons for Elementor versions 51.1.76...

CVE-2026-65502: Authentication Bypass by Spoofing

Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons = 8.7.13 versions...

CVE-2026-65549: Deserialization of Untrusted Data

Author PHP Object Injection in Jeg Kit for Elementor = 3.2.10 versions...

PT-2026-68479

Name of the Vulnerable Software and Affected Versions Element Pack Addons for Elementor versions prior to 8.3.16 Description An Email Header Injection issue exists due to insufficient sanitization of newline characters in user-supplied input that is concatenated into email headers. This allows...

CVE-2026-0673: Improper Neutralization of CRLF Sequences

The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 8.3.15 via the elementpackcontactform AJAX action. This is due to insufficient sanitization of newline characters in user-supplied input that gets concatenated...

CVE-2026-66688: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Ultimate Addons for Elementor = 1.45.2 versions...

PT-2026-68510

Name of the Vulnerable Software and Affected Versions Unlimited Elements For Elementor Free Widgets, Addons, Templates versions prior to 2.0.15 Description A contributor can perform an arbitrary file download, allowing them to retrieve files from the server that they should not have access to...

CVE-2026-28146: Improper Limitation of a Pathname to a Restricted Directory

Contributor Arbitrary File Download in Unlimited Elements For Elementor Free Widgets, Addons, Templates = 2.0.14 versions...

CVE-2026-25403: Missing Authorization

Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons = 3.0.5 versions...

PT-2026-68502

Name of the Vulnerable Software and Affected Versions Ultimate Store Kit Elementor Addons versions prior to 3.0.6 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions. Recommendations Update to a version newer than 3.0.5...

PT-2026-68588

Name of the Vulnerable Software and Affected Versions Ultimate Addons for Elementor versions prior to 1.45.3 Description Cross Site Scripting XSS allows an attacker with contributor privileges to execute malicious scripts in the browser of other users. This occurs when the application fails to...

K000162764: WordPress Crumber (Elementor Plugin) vulnerability CVE-2025-66143

Security Advisory Description Missing Authorization vulnerability in merkulove Crumber crumber-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Crumber: from n/a through = 1.0.10. CVE-2025-66143 Impact There is no impact; F5 products are not...