CVE-2026-94573

The Repeater Fields for Elementor Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.2.7 . The root cause is insufficient input sanitization and output escaping within the Repeater Field Value. This flaw allows unauthenticated attac...

EUVD-2026-86578

The Repeater Fields for Elementor Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Field Value in all versions up to, and including, 2.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-62062

Cross-Site Request Forgery CSRF vulnerability in Elementor Website Builder allows Cross Site Request Forgery. This issue affects Elementor Website Builder: from n/a through 4.3.1...

EUVD-2026-86532

Cross-Site Request Forgery CSRF vulnerability in Elementor Website Builder allows Cross Site Request Forgery. This issue affects Elementor Website Builder: from n/a through 4.3.1...

CVE-2026-62062

The Elementor Website Builder and Elementor Pro (versions 4.3.0 through 4.3.1 ) are vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability (CWE-352). The root cause is that the software skips WordPress REST API nonce validation when the REQUEST_URI contains elementor/v1/events/. Specific...

CVE-2026-62062 WordPress Elementor Website Builder plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Elementor Website Builder allows Cross Site Request Forgery. This issue affects Elementor Website Builder: from n/a through 4.3.1...

CVE-2026-62062 WordPress Elementor Website Builder plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Elementor Website Builder allows Cross Site Request Forgery. This issue affects Elementor Website Builder: from n/a through 4.3.1...

WordPress Elementor Website Builder plugin 4.3.0-4.3.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Sakri Koskimies in WordPress Plugin Elementor Website Builder versions 4.3.0-4.3.1...

Elementor Website Builder - Remote Code Execution

The Elementor Website Builder plugin for WordPress versions 3.6.0 to 3.6.2 are vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the /core/app/modules/onboarding/module.php file. This makes it possible for attackers to modify site data and upload...

CVE-2026-62062: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Elementor Website Builder allows Cross Site Request Forgery. This issue affects Elementor Website Builder: from n/a through 4.3.1...

CVE-2026-94573: Improper Neutralization of Input During Web Page Generation

The Repeater Fields for Elementor Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Field Value in all versions up to, and including, 2.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

PT-2026-98356

Name of the Vulnerable Software and Affected Versions Elementor Website Builder versions 4.3.0 through 4.3.1 Elementor Pro versions 4.3.0 through 4.3.1 Description A Cross-Site Request Forgery CSRF flaw exists where a logged-in administrator can be tricked into opening a crafted link, leading to...

VulnCheck KEV: CVE-2026-62062

Cross-Site Request Forgery CSRF vulnerability in Elementor Website Builder allows Cross Site Request Forgery. This issue affects Elementor Website Builder: from n/a through 4.3.1...

PT-2026-98397

Name of the Vulnerable Software and Affected Versions Repeater Fields for Elementor Forms versions prior to 2.2.8 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into...

WordPress King Addons for Elementor plugin <= 51.1.85 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin King Addons for Elementor versions = 51.1.85...

WordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.5.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin The Plus Addons for Elementor Page Builder Lite versions = 6.5.1...

CVE-2026-88843 MasterStudy LMS 3.5.29 - < 3.7.50 - Contributor+ LFI via Elementor Courses Categories Widget

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path w...

CVE-2026-88843

The MasterStudy LMS WordPress Plugin (versions before 3.7.50 ) contains a vulnerability where a display-style setting is not properly validated when building a template path. This flaw allows users with the Contributor role or higher to perform local file inclusion and execute arbitrary local PHP...

CVE-2026-88843 MasterStudy LMS 3.5.29 - < 3.7.50 - Contributor+ LFI via Elementor Courses Categories Widget

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path w...

PT-2026-97712

Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.50 Description Insufficient validation of a display-style setting allows users with the Contributor role and above to perform Local File Inclusion LFI, which is a technique used to trick a...