CVE-2026-2600-POC

CVE-2026-2600 ElementsKit Elementor Addons $item echo '' . $item'ekittabtitle' . ''; Elementor のエディタはクライアント側で入力をサニタイズしますが、REST API エンドポイント（/wp-json/wp/v2/posts/id）は elementordata メタフィールドを直接受け入れるため、その層を完全にバイパスします。 認証済みの Contributor は、ekittabtitle に任意の HTML を設定した細工済みの Elementor JSON ペイロードで投稿を PATCH...

CVE-2026-32475-PoC

CVE-2026-32475 — Elementor Pro 未认证任意文件上传 → RCE CVE-2026-32475 （CVSS 9.0）的概念验证：WordPress 插件 Elementor Pro （≤ 4.2.1）中存在未认证的任意文件上传漏洞，可导致远程代码执行。 | ---|--- CVE| CVE-2026-32475 CVSS| 9.0 严重 CWE| CWE-434（危险类型文件的不受限上传） 所需认证| 无 受影响版本| Elementor Pro ≤ 4.2.1 修复版本| Elementor Pro 4.2.2（2026-08-19） 报告者| Tin Ph...

CVE-2025-30911

CVE-2025-30911 漏洞利用 – WordPress RomethemeKit = 1.5.4 该脚本利用 RomethemeKit For Elementor WordPress 插件（ = v1.5.4） 中的一个严重漏洞 ，该漏洞允许经过身份验证的任意插件安装与激活 ，最终可能导致远程代码执行（RCE） 。 🛠️ 漏洞概述 CVE 编号 ：CVE-2025-30911 插件 ：RomethemeKit For Elementor 受影响版本 ：= 1.5.4 漏洞类型 ：任意插件安装与激活 → RCE CWE ：CWE-94：代码生成控制不当 CVSS 评分 ：9.9（严重...

WP-CVE-2023-5360

WP-CVE-2023-5360 Royal Elementor Addons and Templates = 1.3.78 – 未認証の任意ファイルアップロード Python 2.7 寄付 : Bitcoin $: 14nXhmRiQx5joCXFTdR8ydm3T8et7MFDXC 使用方法 Python 2.7 をインストール ここからダウンロード python file.py 参照 :...

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.20...

CVE-2026-103064

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Wpmet ElementsKit Elementor addons Lite elementskit-lite allows Stored XSS.This issue affects ElementsKit Elementor addons Lite: from n/a through 4.0.6...

CVE-2026-103338

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor...

CVE-2026-103341

Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Unlimited Elements For Elementor Free Widgets,...

CVE-2026-102394

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through 6.8.4...

CVE-2026-103063

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Wpmet ElementsKit Elementor addons Lite elementskit-lite allows Stored XSS.This issue affects ElementsKit Elementor addons Lite: from n/a through 4.0.6...

EUVD-2026-90805

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through 6.8.4...

CVE-2026-102394 WordPress Essential Addons for Elementor plugin <= 6.8.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through 6.8.4...

CVE-2026-102394

The Essential Addons for Elementor WordPress plugin (versions

CVE-2026-102394 WordPress Essential Addons for Elementor plugin <= 6.8.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through 6.8.4...

WordPress Essential Addons for Elementor plugin <= 6.8.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin Essential Addons for Elementor versions = 6.8.4...

CVE-2026-103063 WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Wpmet ElementsKit Elementor addons Lite elementskit-lite allows Stored XSS.This issue affects ElementsKit Elementor addons Lite: from n/a through 4.0.6...

CVE-2026-103063 WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Wpmet ElementsKit Elementor addons Lite elementskit-lite allows Stored XSS.This issue affects ElementsKit Elementor addons Lite: from n/a through 4.0.6...

EUVD-2026-90802

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Wpmet ElementsKit Elementor addons Lite elementskit-lite allows Stored XSS.This issue affects ElementsKit Elementor addons Lite: from n/a through 4.0.6...

CVE-2026-103063

The ElementsKit Elementor addons Lite WordPress plugin (versions

WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin ElementsKit Elementor addons Lite versions = 4.0.6...