VulnCheck KEV: CVE-2026-4885

The Piotnet Addons for Elementor Pro plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the 'pafeajaxformbuilder' function in all versions up to, and including, 7.1.70. The plugin uses an incomplete extension blacklist that only blocks php, phpt,...

CVE-2026-39754

Contributor Arbitrary File Download in Piotnet Addons For Elementor = 7.1.71 versions...

EUVD-2026-93263

Contributor Arbitrary File Download in Piotnet Addons For Elementor = 7.1.71 versions...

CVE-2026-39754 WordPress Piotnet Addons For Elementor plugin <= 7.1.71 - Arbitrary File Download vulnerability

Contributor Arbitrary File Download in Piotnet Addons For Elementor = 7.1.71 versions...

CVE-2026-39754 WordPress Piotnet Addons For Elementor plugin <= 7.1.71 - Arbitrary File Download vulnerability

Contributor Arbitrary File Download in Piotnet Addons For Elementor = 7.1.71 versions...

CVE-2026-39754

The Piotnet Addons For Elementor plugin for WordPress (versions

CVE-2026-39754: Improper Limitation of a Pathname to a Restricted Directory

Contributor Arbitrary File Download in Piotnet Addons For Elementor = 7.1.71 versions...

PT-2026-106428

Contributor Arbitrary File Download in Piotnet Addons For Elementor = 7.1.71 versions...

WordPress Piotnet Addons For Elementor plugin <= 7.1.71 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by dutafi in WordPress Plugin Piotnet Addons For Elementor versions = 7.1.71...

CVE-2026-28192: Unrestricted Upload of File with Dangerous Type

Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro = 7.1.67 versions...

CVE-2026-4885: Unrestricted Upload of File with Dangerous Type

The Piotnet Addons for Elementor Pro plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the 'pafeajaxformbuilder' function in all versions up to, and including, 7.1.70. The plugin uses an incomplete extension blacklist that only blocks php, phpt,...

PT-2025-17249 · WordPress · Piotnet Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Piotnet Addons For Elementor plugin for WordPress versions up to, and including, 2.4.34 Description: The issue is related to Stored Cross-Site Scripting via the 'PAFE Before After Image Comparison Slider' widget due to insufficient input...

CVE-2024-13650: Improper Neutralization of Input During Web Page Generation

The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'PAFE Before After Image Comparison Slider' widget in all versions up to, and including, 2.4.36 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-32197

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in piotnetdotcom Piotnet Addons For Elementor piotnet-addons-for-elementor allows Stored XSS.This issue affects Piotnet Addons For Elementor: from n/a through = 2.4.36...

CVE-2025-32197

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in piotnetdotcom Piotnet Addons For Elementor piotnet-addons-for-elementor allows Stored XSS.This issue affects Piotnet Addons For Elementor: from n/a through = 2.4.36...

WordPress Piotnet Addons For Elementor plugin <= 2.4.36 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara Kinorth in WordPress Plugin Piotnet Addons For Elementor versions = 2.4.36...

CVE-2025-32197: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in piotnetdotcom Piotnet Addons For Elementor piotnet-addons-for-elementor allows Stored XSS.This issue affects Piotnet Addons For Elementor: from n/a through = 2.4.36...

CVE-2024-10775 Piotnet Addons For Elementor <= 2.4.32 - Authenticated (Contributor+) Post Disclosure

The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.4.32 via the 'pafe-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with...

CVE-2024-10775: Authorization Bypass Through User-Controlled Key

The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.4.32 via the 'pafe-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with...

CVE-2025-22333

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in piotnetdotcom Piotnet Addons For Elementor piotnet-addons-for-elementor allows Stored XSS.This issue affects Piotnet Addons For Elementor: from n/a through = 2.4.31...