WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
elementskit-lite
Published
2024-09-24
Title
ElementsKit Elementor addons < 3.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Widget
Slug
elementskit-lite
Published
2024-10-25
Title
ElementsKit Elementor addons < 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison Widget
Slug
elementskit-lite
Published
2025-02-14
Title
ElementsKit Elementor addons < 3.4.1 - Contributor+ Stored XSS
Slug
elementskit-lite
Published
2025-02-18
Title
ElementsKit Elementor addons < 3.4.1 - Unauthenticated Information Exposure
Slug
elementskit-lite
Published
2025-03-28
Title
ElementsKit Elementor addons < 3.4.8 - Contributor+ Stored XSS
Slug
elementskit-lite
Published
2025-06-18
Title
ElementsKit Lite < 3.5.3 - Contributor+ Stored XSS via Image Comparison Widget
Slug
elementskit-lite
Published
2025-07-24
Title
ElementsKit Elementor Addons and Templates < 3.5.3 - Contributor+ Stored XSS
Slug
elementskit-lite
Published
2026-02-24
Title
ElementsKit Elementor addons Lite < 3.7.9 - Missing Authorization
Slug
elementskit-lite
Published
2026-04-03
Title
ElementsKit Elementor Addons and Templates < 3.8.0 - Contributor+ Stored XSS via Simple Tab Widget
Slug
elementskit-lite
Published
2026-05-04
Title
ElementsKit Elementor Addons < 3.9.0 - Unauthenticated Missing Authorization to Widget Content Overwrite
Slug
elementskit-lite
Published
2026-05-27
Title
ElementsKit Elementor Addons < 3.9.7 - Contributor+ Missing Authorization
Slug
elementskit-lite
Published
2026-05-27
Title
ElementsKit Elementor Addons <= 3.9.6 - Unauthenticated Missing Authorization
Slug
elementskit-lite
Published
2026-07-14
Title
ElementsKit Lite < 3.10.01 - Subsite Administrator+ Stored XSS via Megamenu Menu-Item Settings (Multisite)
Slug
elementskit-lite
Published
2026-07-14
Title
ElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget Builder (Multisite)
Slug
elespare
Published
2024-04-22
Title
Elespare – Build Your Blog, News & Magazine Websites with Expert-Designed Template Kits. One Click Import: No Coding Skills Required! < 2.1.3 - Missing Authorization to Subscriber+ Arbitrary Post Creation
Slug
elespare
Published
2024-06-12
Title
Elespare – Blog, Magazine and Newspaper Addons for Elementor with Templates, Widgets, Kits, and Header/Footer Builder. One Click Import: No Coding Required! < 3.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Horizontal Nav Menu Widge
Slug
elespare
Published
2026-04-30
Title
Freemius < 2.11.0 - Reflected DOM-Based XSS via url Parameter
Slug
elevio
Published
2025-01-03
Title
Elevio <= 4.4.1 - Cross-Site Request Forgery
Slug
elex-bulk-edit-products-prices-attributes-for-woocommerce-basic
Published
2025-01-03
Title
ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes < 1.5.0 - Shop manager+ SQL Injection
Slug
elex-bulk-edit-products-prices-attributes-for-woocommerce-basic
Published
2025-04-23
Title
ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes < 1.5.0 - Authenticated (Subscriber+) SQL Injection
Slug
elex-bulk-edit-products-prices-attributes-for-woocommerce-basic
Published
2025-07-15
Title
ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes < 1.5.0 - Authenticated (Subscriber+) SQL Injection
Slug
elex-helpdesk-customer-support-ticket-system
Published
2025-01-31
Title
ELEX WordPress HelpDesk & Customer Ticketing System < 3.2.7 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
Slug
elex-helpdesk-customer-support-ticket-system
Published
2025-05-08
Title
ELEX WordPress HelpDesk & Customer Ticketing System < 3.3.0 - Subscriber+ Arbitrary File Upload
Slug
elex-helpdesk-customer-support-ticket-system
Published
2025-11-20
Title
ELEX WordPress HelpDesk & Customer Ticketing System < 3.3.2 - Missing Authorization to Authenticated (Subscriber+) Ticket Restore
Slug
elex-helpdesk-customer-support-ticket-system
Published
2025-11-20
Title
ELEX WordPress HelpDesk & Customer Ticketing System < 3.3.2 - Missing Authorization to Authenticated (Subscriber+) Trash Empty