Veille CVE

Recherche « Unknown Essential Addons for Elementor »

5 CVE

Critique 0 Élevée 1 Moyenne 2 Faible 2 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown Essential Addons for Elementor » ✕
  1. CVE-2026-110537 3.8 Faible

    Unknown Essential Addons for Elementor

    The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user accounts targeted by its login-approval feature, checking only a site-level capability, which on WordPress Multisite could allow a subsite administrator to change the approval and login state of accounts belonging to other sites on the network.

  2. CVE-2026-110510 3.5 Faible

    Unknown Essential Addons for Elementor

    The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widgets before using it to build markup, which could allow users with the author role and above to inject iframe and form elements into published pages.

  3. CVE-2026-18039 8.1 Élevée

    Unknown Essential Addons for Elementor

    The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration fields from overwriting reserved account attributes, allowing unauthenticated attackers to register an account with an arbitrary role, including administrator, on sites where a custom profile field with a particular label has been configured.

  4. CVE-2026-13345 5.3 Moyenne

    Unknown Essential Addons for Elementor

    The Essential Addons for Elementor WordPress plugin before 6.6.10 does not perform authorization, status, or visibility checks when resolving WooCommerce products in its product-comparison feature, allowing unauthenticated users to disclose the title, price, and SKU of draft, pending, and private products that are otherwise withheld from public view.

  5. CVE-2026-13344 4.8 Moyenne

    Unknown Essential Addons for Elementor

    The Essential Addons for Elementor WordPress plugin before 6.6.10 does not validate the HTML tag name of the Pricing Table widget title before outputting it, allowing users with Contributor-level access and above to inject JavaScript that will be executed (Stored Cross-Site Scripting) when the page is viewed, including in the session of an administrator previewing or visiting the post.