Veille CVE

Recherche « wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets »

6 CVE

Critique 0 Élevée 1 Moyenne 5 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets » ✕
  1. CVE-2026-15145 6.4 Moyenne

    wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets

    The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Fancy Text Widget in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  2. CVE-2026-15156 6.4 Moyenne

    wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets

    The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Reading Progress Global Color Settings in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  3. CVE-2026-15155 8.8 Élevée

    wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets

    The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Authenticated Account Takeover via Email Header Injection in all versions up to, and including, 6.6.10 This is due to insufficient server-side validation of a Login/Register widget setting used to construct outgoing email headers — the allowed-values restriction is enforced only in the client-side editor UI and not on the server, and the applied sanitization does not strip or encode CR/LF characters, allowing CRLF sequences stored in that setting to survive into raw mail headers. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject an additional Bcc header into the WordPress administrator's password-reset notification email, receive a copy of a valid administrator password-reset link, and achieve full administrator account takeover.

  4. CVE-2026-6459 6.4 Moyenne

    wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets

    The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Event Calendar widget in all versions up to, and including, 6.6.2 due to insufficient input sanitization and output escaping on event titles sourced from The Events Calendar. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  5. CVE-2026-7665 5.3 Moyenne

    wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets

    The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.6.4 via the ajax_load_more function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

  6. CVE-2026-5193 6.5 Moyenne

    wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets

    The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 6.5.13. This is due to insufficient role validation in the 'register_user' function, which only blocks the 'administrator' role. This makes it possible for authenticated attackers, with author level access and above, to create new user accounts with elevated privileges such as editor.