CVE-2026-86809

The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to the transaction being completed, allowing unauthenticated attackers to complete a pending order using a valid payment authority obtained...

CVE-2026-86809 Persian Elementor < 2.8.2 - Unauthenticated ZarinPal Payment Callback Authority Bypass

The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to the transaction being completed, allowing unauthenticated attackers to complete a pending order using a valid payment authority obtained...

CVE-2026-86809

The Persian Elementor WordPress plugin, versions 2.7.10 through before 2.8.2 , fails to verify that the payment authority returned in its ZarinPal payment callback belongs to the specific transaction being completed. This allows unauthenticated attackers to complete a pending order by replaying a...

EUVD-2026-76040

The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to the transaction being completed, allowing unauthenticated attackers to complete a pending order using a valid payment authority obtained...

CVE-2026-86809 Persian Elementor < 2.8.2 - Unauthenticated ZarinPal Payment Callback Authority Bypass

The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to the transaction being completed, allowing unauthenticated attackers to complete a pending order using a valid payment authority obtained...

WordPress Unlimited Elements For Elementor plugin <= 2.0.16 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.16...

Exploit for CVE-2026-18351

CVE-2026-18351 Mass exploit tool for CVE-2026-18351 — Una...

CVE-2026-18561 Unlimited Elements For Elementor <= 2.0.16 - Unauthenticated SQL Injection

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in...

CVE-2026-18561 Unlimited Elements For Elementor <= 2.0.16 - Unauthenticated SQL Injection

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in...

Exploit for CVE-2026-18351

Exploit-CVE-2026-18351 Drag and Drop File Uploa...

PT-2026-90024

Editor SQL Injection in Sky Addons for Elementor = 3.8.4 versions...

PT-2026-90018

Missing Authorization vulnerability in Pixar Labs Master Addons for Elementor allows Privilege Abuse. This issue affects Master Addons for Elementor: from n/a through 3.2.2...

WordPress Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin <= 1.7.1066 - Unauthenticated Sensitive Information Exposure vulnerability

Unauthenticated Sensitive Information Exposure vulnerability discovered by TarPeg007 in WordPress Plugin Royal Elementor Addons versions = 1.7.1066...

CVE-2026-62109: Improper Neutralization of Special Elements used in an SQL Command

Editor SQL Injection in Sky Addons for Elementor = 3.8.4 versions...

CVE-2026-62089: Missing Authorization

Missing Authorization vulnerability in Pixar Labs Master Addons for Elementor allows Privilege Abuse. This issue affects Master Addons for Elementor: from n/a through 3.2.2...

CVE-2026-86809: Insufficient Verification of Data Authenticity

The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to the transaction being completed, allowing unauthenticated attackers to complete a pending order using a valid payment authority obtained...

CVE-2026-77150: Improper Neutralization of Input During Web Page Generation

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'dataname' Parameter in all versions up to, and including, 2.0.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

PT-2026-89749

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in...

CVE-2026-18561: Improper Neutralization of Special Elements used in an SQL Command

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in...

PT-2026-90661

Name of the Vulnerable Software and Affected Versions Booking for Appointments and Events Calendar versions prior to 2.5.0 Description Stored Cross-Site Scripting occurs via multiple Elementor widgets due to insufficient input sanitization and output escaping on the load manually parameter within...