Veille CVE

Recherche « Unknown King Addons for Elementor »

7 CVE

Critique 0 Élevée 0 Moyenne 4 Faible 3 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown King Addons for Elementor » ✕
  1. CVE-2026-110537 3.8 Faible

    Unknown Essential Addons for Elementor

    The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user accounts targeted by its login-approval feature, checking only a site-level capability, which on WordPress Multisite could allow a subsite administrator to change the approval and login state of accounts belonging to other sites on the network.

  2. CVE-2026-84904 3.8 Faible

    Unknown King Addons for Elementor

    The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownership of the targeted object, allowing authenticated users with author-level access and above to disclose absolute file paths for, overwrite the bytes of, and site-wide re-reference media belonging to other users, including administrators.

  3. CVE-2026-84903 2.7 Faible

    Unknown King Addons for Elementor

    The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password check before rendering the content of a user-supplied post, allowing users with Contributor-level access and above to read the content of private, draft, pending, and password-protected posts they are not authorized to access.

  4. CVE-2026-84902 6.8 Moyenne

    Unknown King Addons for Elementor

    The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when importing template content into a page, allowing users with contributor-level access and above to overwrite the Elementor content of arbitrary posts and pages, including those owned by administrators, and to inject JavaScript through a widget setting that is output without escaping, resulting in Stored Cross-Site Scripting that executes in the session of any user who views the affected page.

  5. CVE-2026-84896 6.8 Moyenne

    Unknown King Addons for Elementor

    The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before outputting it in an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of any visitor to the affected page, including logged-in administrators.

  6. CVE-2026-13404 5.3 Moyenne

    Unknown Royal Addons for Elementor

    The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check (relying only on a publicly-scrapeable nonce) before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID, allowing unauthenticated users to modify that metadata on any post, including private and draft posts.

  7. CVE-2026-14841 6.1 Moyenne

    Unknown King Addons for Elementor

    The King Addons for Elementor WordPress plugin before 51.1.76 does not escape a user-supplied grid setting before reflecting it into an HTML attribute in an unauthenticated AJAX response, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who is tricked into loading a crafted page.