Lucene search
+L

6 matches found

NVD
NVD
added 4 days ago8 views

CVE-2026-17123

The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhookurl' setting. The widget's render method persists the attacker-controlled URL into the wprwebhookurlwidgetid option on ever...

8.8CVSS0.00355EPSS
SaveExploits0References7
Cvelist
Cvelist
added 4 days ago38 views

CVE-2026-17123 Royal Addons for Elementor <= 1.7.1064 - Authenticated (Contributor+) Server-Side Request Forgery via Form Builder Widget 'webhook_url' Setting

The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhookurl' setting. The widget's render method persists the attacker-controlled URL into the wprwebhookurlwidgetid option on ever...

8.8CVSS0.00355EPSS
SaveExploits0References7
ATTACKERKB
ATTACKERKB
added 4 days ago9 views

CVE-2026-17123

The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhookurl' setting. The widget's render method persists the attacker-controlled URL into the wprwebhookurlwidgetid option on ever...

8.8CVSS5.5AI score0.00355EPSS
SaveExploits0References8
CVE
CVE
added 4 days ago44 views

CVE-2026-17123

The CVE describe a Server-Side Request Forgery in the Royal Elementor Addons WordPress plugin (versions ≤ 1.7.1064). The Form Builder widget’s webhook_url setting persists attacker-controlled URLs into wpr_webhook_url_{widget_id} on each render. The wpr_form_builder_webhook AJAX handler, usable b...

8.8CVSS5.5AI score0.00355EPSS
SaveExploits0References7
EUVD
EUVD
added 4 days ago9 views

EUVD-2026-59863

The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhookurl' setting. The widget's render method persists the attacker-controlled URL into the wprwebhookurlwidgetid option on ever...

8.8CVSS5.5AI score0.00355EPSS
SaveExploits0References7
CVE
CVE
added 2026/07/10 1:58 p.m.18 views

CVE-2026-60091

PraisionAI before 4.6.78 is affected by an unauthenticated SSRF in the Jobs API /api/v1/runs. The webhook_url parameter is validated at request time but re-resolved at connection time, enabling DNS rebinding to reach internal services via a blind SSRF attack. CVSS metrics: CVSSv3.1 base score 7.2...

7.2CVSS6.1AI score0.0018EPSS
SaveExploits0References2
Rows per page
Query Builder