CVE-2023-1807

The CVE-2023-1807 entry concerns the Elementor Addons, Widgets and Enhancements – Stax plugin for WordPress. The root cause is missing or incorrect nonce validation in the toggle_widget function, allowing Cross-Site Request Forgery. Affected are WordPress sites running Stax up to version 1.4.3. I...

CVE-2023-2189

CVE-2023-2189 affects Elementor Addons, Widgets and Enhancements – Stax for WordPress. Cause: missing capability check in toggle_widget (versions up to 1.4.3). Impact: authenticated users with subscriber-level permissions+ can enable/disable Elementor widgets. Patch status: Unpatched per Wordfenc...

CVE-2024-37541

CVE-2024-37541 concerns a stored XSS in the WordPress plugin package “Stax” (Elementor Addons, Widgets and Enhancements – Stax) for WordPress. The issue stems from improper neutralization of input during web page generation, affecting Stax versions up to 1.4.4.1 (inclusive). The available connect...