15194 matches found
CVE-2025-8081-Elementor
CVE-2025-8081 - Elementor 任意文件读取の脆弱性 Elementor WordPress プラグインにおける深刻な任意ファイル読み取りの脆弱性。認証された管理者が、Web サーバーがアクセス可能な任意のファイル（データベース認証情報を含む機密設定ファイルなど）を読み取ることができます。 📋 脆弱性の概要 CVE 情報 プロパティ| 値 ---|--- CVE ID| CVE-2025-8081 タイプ| 任意ファイル読み取り CWE-22: パストラバーサル CVSS スコア| 4.9 中 - 実際の影響: 重大 CVSS ベクター|...
CVE-2026-2600-POC
CVE-2026-2600 ElementsKit Elementor Addons $item echo '' . $item'ekittabtitle' . ''; Elementor のエディタはクライアント側で入力をサニタイズしますが、REST API エンドポイント（/wp-json/wp/v2/posts/id）は elementordata メタフィールドを直接受け入れるため、その層を完全にバイパスします。 認証済みの Contributor は、ekittabtitle に任意の HTML を設定した細工済みの Elementor JSON ペイロードで投稿を PATCH...
CVE-2026-32475-PoC
CVE-2026-32475 — Elementor Pro 未认证任意文件上传 → RCE CVE-2026-32475 （CVSS 9.0）的概念验证：WordPress 插件 Elementor Pro （≤ 4.2.1）中存在未认证的任意文件上传漏洞，可导致远程代码执行。 | ---|--- CVE| CVE-2026-32475 CVSS| 9.0 严重 CWE| CWE-434（危险类型文件的不受限上传） 所需认证| 无 受影响版本| Elementor Pro ≤ 4.2.1 修复版本| Elementor Pro 4.2.2（2026-08-19） 报告者| Tin Ph...
CVE-2025-30911
CVE-2025-30911 漏洞利用 – WordPress RomethemeKit = 1.5.4 该脚本利用 RomethemeKit For Elementor WordPress 插件（ = v1.5.4） 中的一个严重漏洞 ，该漏洞允许经过身份验证的任意插件安装与激活 ，最终可能导致远程代码执行（RCE） 。 🛠️ 漏洞概述 CVE 编号 ：CVE-2025-30911 插件 ：RomethemeKit For Elementor 受影响版本 ：= 1.5.4 漏洞类型 ：任意插件安装与激活 → RCE CWE ：CWE-94：代码生成控制不当 CVSS 评分 ：9.9（严重...
WP-CVE-2023-5360
WP-CVE-2023-5360 Royal Elementor Addons and Templates = 1.3.78 – 未認証の任意ファイルアップロード Python 2.7 寄付 : Bitcoin $: 14nXhmRiQx5joCXFTdR8ydm3T8et7MFDXC 使用方法 Python 2.7 をインストール ここからダウンロード python file.py 参照 :...
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.20...
CVE-2026-103064
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Wpmet ElementsKit Elementor addons Lite elementskit-lite allows Stored XSS.This issue affects ElementsKit Elementor addons Lite: from n/a through 4.0.6...
CVE-2026-103338
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor...
CVE-2026-103341
Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Unlimited Elements For Elementor Free Widgets,...
CVE-2026-102394
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through 6.8.4...
CVE-2026-103063
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Wpmet ElementsKit Elementor addons Lite elementskit-lite allows Stored XSS.This issue affects ElementsKit Elementor addons Lite: from n/a through 4.0.6...
EUVD-2026-90805
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through 6.8.4...
CVE-2026-102394 WordPress Essential Addons for Elementor plugin <= 6.8.4 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through 6.8.4...
CVE-2026-102394
The Essential Addons for Elementor WordPress plugin (versions
CVE-2026-102394 WordPress Essential Addons for Elementor plugin <= 6.8.4 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through 6.8.4...
WordPress Essential Addons for Elementor plugin <= 6.8.4 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin Essential Addons for Elementor versions = 6.8.4...
CVE-2026-103063 WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Wpmet ElementsKit Elementor addons Lite elementskit-lite allows Stored XSS.This issue affects ElementsKit Elementor addons Lite: from n/a through 4.0.6...
CVE-2026-103063 WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Wpmet ElementsKit Elementor addons Lite elementskit-lite allows Stored XSS.This issue affects ElementsKit Elementor addons Lite: from n/a through 4.0.6...
EUVD-2026-90802
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Wpmet ElementsKit Elementor addons Lite elementskit-lite allows Stored XSS.This issue affects ElementsKit Elementor addons Lite: from n/a through 4.0.6...