CVE-2026-4885

CVE-2026-4885 – Explotación masiva de Piotnet Addons para Elementor Pro Carga arbitraria de archivos no autenticada que conduce a la ejecución remota de código RCE en Piotnet Addons for Elementor Pro ≤ 7.1.70. Esta herramienta está diseñada para la explotación masiva – proporcione una lista de...

CVE-2025-68999-POC

CVE-2025-68999 Happy Addons for Elementor prepare 安全地获取行，但随后将 $entry-metakey 直接插入 SQL 字符串而不进行转义： $records = " $duplicatedpostid, '$entry-metakey', '$value' "; // ... $wpdb-query $query ; 由于 metakey 来自数据库，代码将其视为可信。但贡献者可以通过自定义字段面板设置任意字段名称——因此他们控制该列中的内容。 攻击分为两步： 1. 写入： 将恶意字符串存储为自定义字段名称。addpostmeta...

CVE-2022-1329

WP Elementor 3.6.0/1/2 リモートコード実行 Google Dork: なし 日付: 2022年4月16日 エクスプロイト作者: AkuCyberSec https://github.com/AkuCyberSec ベンダーホームページ: https://elementor.com/ ソフトウェアリンク: https://wordpress.org/plugins/elementor/advanced/ スクロールダウンしてバージョンを選択 バージョン: 3.6.0, 3.6.1, 3.62 テスト環境: WordPress 5.9.3...

Exploit for CVE-2026-62062

abraxaslabs.tech · github.com/abraxas ·&...

WordPress Repeater Fields for Elementor Forms plugin <= 2.2.7 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by nthng in WordPress Plugin Repeater Fields for Elementor Forms versions = 2.2.7...

CVE-2026-94573

The Repeater Fields for Elementor Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Field Value in all versions up to, and including, 2.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-94573 Repeater Fields for Elementor Forms <= 2.2.7 - Unauthenticated Stored Cross-Site Scripting via Repeater Field Value

The Repeater Fields for Elementor Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Field Value in all versions up to, and including, 2.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-94573 Repeater Fields for Elementor Forms <= 2.2.7 - Unauthenticated Stored Cross-Site Scripting via Repeater Field Value

The Repeater Fields for Elementor Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Field Value in all versions up to, and including, 2.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

EUVD-2026-86578

The Repeater Fields for Elementor Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Field Value in all versions up to, and including, 2.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-94573

The Repeater Fields for Elementor Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.2.7 . The root cause is insufficient input sanitization and output escaping within the Repeater Field Value. This flaw allows unauthenticated attac...

CVE-2026-62062

Cross-Site Request Forgery CSRF vulnerability in Elementor Website Builder allows Cross Site Request Forgery. This issue affects Elementor Website Builder: from n/a through 4.3.1...

EUVD-2026-86532

Cross-Site Request Forgery CSRF vulnerability in Elementor Website Builder allows Cross Site Request Forgery. This issue affects Elementor Website Builder: from n/a through 4.3.1...

CVE-2026-62062

The Elementor Website Builder and Elementor Pro (versions 4.3.0 through 4.3.1 ) are vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability (CWE-352). The root cause is that the software skips WordPress REST API nonce validation when the REQUEST_URI contains elementor/v1/events/. Specific...

CVE-2026-62062 WordPress Elementor Website Builder plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Elementor Website Builder allows Cross Site Request Forgery. This issue affects Elementor Website Builder: from n/a through 4.3.1...

CVE-2026-62062 WordPress Elementor Website Builder plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Elementor Website Builder allows Cross Site Request Forgery. This issue affects Elementor Website Builder: from n/a through 4.3.1...

WordPress Elementor Website Builder plugin 4.3.0-4.3.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Sakri Koskimies in WordPress Plugin Elementor Website Builder versions 4.3.0-4.3.1...

Elementor Website Builder - Remote Code Execution

The Elementor Website Builder plugin for WordPress versions 3.6.0 to 3.6.2 are vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the /core/app/modules/onboarding/module.php file. This makes it possible for attackers to modify site data and upload...

CVE-2026-94573: Improper Neutralization of Input During Web Page Generation

The Repeater Fields for Elementor Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Field Value in all versions up to, and including, 2.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-62062: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Elementor Website Builder allows Cross Site Request Forgery. This issue affects Elementor Website Builder: from n/a through 4.3.1...

PT-2026-98397

Name of the Vulnerable Software and Affected Versions Repeater Fields for Elementor Forms versions prior to 2.2.8 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into...