15279 matches found
CVE-2026-18405: Improper Neutralization of Input During Web Page Generation
The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.2.16 due to insufficient input sanitization and output escaping. This makes it...
PT-2026-95299
Name of the Vulnerable Software and Affected Versions Qi Addons For Elementor versions prior to 1.12 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when the Table of Contents widget is placed o...
CVE-2026-84903: Exposure of Sensitive Information to an Unauthorized Actor
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password check before rendering the content of a user-supplied post, allowing users with Contributor-level access and above to read the content of private, draft, pending, and...
CVE-2026-84904: Missing Authorization
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownership of the targeted object, allowing...
CVE-2026-92249: Improper Neutralization of Input During Web Page Generation
The Qi Addons For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 1.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary we...
CVE-2026-15650: Improper Neutralization of Input During Web Page Generation
The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pointermenuitem' Block Attribute in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-84902: Improper Neutralization of Input During Web Page Generation
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when importing template content into a page, allowing users with contributor-level access and above to overwrite the Elementor content of arbitrary posts and pages, including those...
CVE-2026-83561: Improper Neutralization of Input During Web Page Generation
The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Elementor Cookie Blocker Regex in all versions up to, and including, 7.5.4 due to insufficient input sanitization and output escaping. This makes it possible for...
PT-2026-95334
Name of the Vulnerable Software and Affected Versions Master Addons for Elementor versions prior to 3.2.3 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with contributor-level acce...
CVE-2026-85410: Missing Authorization
The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.2. This is due to the plugin not properly verifying that a user is...
CVE-2026-66626
Editor SQL Injection in SKT Addons for Elementor = 4.0 versions...
CVE-2026-66608
Contributor Server Side Request Forgery SSRF in Unlimited Elements For Elementor Free Widgets, Addons, Templates = 2.0.19 versions...
CVE-2026-66575
Unauthenticated Insecure Direct Object References IDOR in King Addons for Elementor = 51.1.81 versions...
CVE-2026-66576
Contributor Cross Site Scripting XSS in JetBlocks For Elementor = 1.5.2 versions...
CVE-2026-66579
Contributor Cross Site Scripting XSS in JetElements For Elementor = 2.9.2.1 versions...
CVE-2026-66574
Contributor Cross Site Scripting XSS in Element Pack Elementor Addons = 8.8.3 versions...
CVE-2026-66626
CVE-2026-66626 is an Editor SQL Injection vulnerability in the WordPress plugin SKT Addons for Elementor (versions ≤ 4.0 ), discovered by Ananda Dhakal via Patchstack. The flaw allows an authenticated user with high privileges to inject SQL through the editor functionality. The CVSS 3.1 score is ...
EUVD-2026-81508
Editor SQL Injection in SKT Addons for Elementor = 4.0 versions...
