CVE-2026-23693: Missing Authentication for Critical Function

ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor elementskit-lite WordPress plugin versions prior to 3.7.9 expose the REST endpoint /wp-json/elementskit/v1/widget/mailchimp/subscribe without authentication. The endpoint accepts client-supplied Mailchimp API...

CVE-2024-2803

The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the countdown widget in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

EUVD-2024-44034

Malicious code in bioql PyPI...

EUVD-2024-27009

Malicious code in bioql PyPI...

EUVD-2024-27013

Malicious code in bioql PyPI...

EUVD-2024-48061

Malicious code in bioql PyPI...

EUVD-2024-32229

Malicious code in bioql PyPI...

EUVD-2024-17004

Malicious code in bioql PyPI...

EUVD-2024-27747

Malicious code in bioql PyPI...

EUVD-2024-32177

Malicious code in bioql PyPI...

EUVD-2024-44071

Malicious code in bioql PyPI...

EUVD-2024-48060

Malicious code in bioql PyPI...

EUVD-2024-47551

Malicious code in bioql PyPI...

EUVD-2024-32899

Malicious code in bioql PyPI...

EUVD-2024-40645

Malicious code in bioql PyPI...

EUVD-2025-4703

Malicious code in bioql PyPI...

CVE-2025-3614

The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attribute of a custom widget in all versions up to, and including, 3.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...

CVE-2025-3614

The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attribute of a custom widget in all versions up to, and including, 3.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...

CVE-2025-3614

The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attribute of a custom widget in all versions up to, and including, 3.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...

CVE-2025-3614 ElementsKit Elementor Addons and Templates <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Widget

The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attribute of a custom widget in all versions up to, and including, 3.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...