Essential Addons For Elementor – Popular Elementor Templates & Widgets
Approved changes feed: RSS · Atom
cpe:2.3:a:wpdevteam:essential_addons_for_elementor_–_popular_elementor_templates_&_widgets:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Wpdevteam (a4902ce9-e562-585a-9979-c349db19e370) |
|---|---|
| Product | Essential Addons For Elementor – Popular Elementor Templates & Widgets (86dbce1e-8a8c-5f86-a5e2-6dbf14dfafd1) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-6459 |
vulnerable | 2026-07-29 01:06:20.890221 |
Essential Addons for Elementor <= 6.6.2 - Authenticated (Author+) Stored Cross-Site Scripting via Event Calendar Widget Popup
MEDIUM (6.4)
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Event Calendar widget in all versions up to, and including, 6.6.2 due to insufficient input sanitization and output escaping on event titles sourced from The Events Calendar. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2026-07-08T12:33:16.005Z
Updated: 2026-07-08T14:11:23.298Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-15156 |
vulnerable | 2026-07-29 00:26:17.843212 |
Essential Addons for Elementor <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Reading Progress Global Color Settings
MEDIUM (6.4)
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Reading Progress Global Color Settings in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2026-07-21T04:33:03.564Z
Updated: 2026-07-22T14:19:38.985Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-15155 |
vulnerable | 2026-07-29 00:26:17.842950 |
Essential Addons for Elementor <= 6.6.10 - Authenticated (Contributor+) Account Takeover via Email Header Injection
HIGH (8.8)
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Authenticated Account Takeover via Email Header Injection in all versions up to, and including, 6.6.10 This is due to insufficient server-side validation of a Login/Register widget setting used to construct outgoing email headers — the allowed-values restriction is enforced only in the client-side editor UI and not on the server, and the applied sanitization does not strip or encode CR/LF characters, allowing CRLF sequences stored in that setting to survive into raw mail headers. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject an additional Bcc header into the WordPress administrator's password-reset notification email, receive a copy of a valid administrator password-reset link, and achieve full administrator account takeover.
Published: 2026-07-11T05:35:49.683Z
Updated: 2026-07-15T13:46:28.209Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-15145 |
vulnerable | 2026-07-29 00:26:17.839631 |
Essential Addons for Elementor <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget
MEDIUM (6.4)
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Fancy Text Widget in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2026-07-21T07:51:21.180Z
Updated: 2026-07-23T14:30:37.508Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-7665 |
vulnerable | 2026-06-08 08:08:57.540791 |
Essential Addons for Elementor <= 6.6.4 - Missing Authorization to Unauthenticated Information Exposure via 'load_more' AJAX Handler
MEDIUM (5.3)
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.6.4 via the ajax_load_more function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.
Published: 2026-06-06T02:28:36.091Z
Updated: 2026-06-06T11:47:54.832Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-5193 |
vulnerable | 2026-06-08 08:07:03.237604 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-1512 |
vulnerable | 2026-06-08 07:49:08.791159 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-1004 |
vulnerable | 2026-06-08 07:47:14.228651 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-8451 |
vulnerable | 2026-06-08 07:45:20.168944 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-6244 |
vulnerable | 2026-06-08 07:43:14.610208 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-13977 |
vulnerable | 2026-06-08 07:06:33.306689 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-9994 |
vulnerable | 2026-06-08 07:00:29.023007 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-9993 |
vulnerable | 2026-06-08 07:00:29.022693 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-8979 |
vulnerable | 2026-06-08 07:00:26.266682 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-8978 |
vulnerable | 2026-06-08 07:00:26.263777 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-8961 |
vulnerable | 2026-06-08 07:00:26.229911 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-8742 |
vulnerable | 2026-06-08 07:00:25.494202 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-8440 |
vulnerable | 2026-06-08 07:00:24.643293 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-7092 |
vulnerable | 2026-06-08 06:58:21.210490 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-5647 |
vulnerable | 2026-06-08 06:56:16.864814 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-5189 |
vulnerable | 2026-06-08 06:56:15.119235 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-5188 |
vulnerable | 2026-06-08 06:56:15.116976 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-5073 |
vulnerable | 2026-06-08 06:56:14.775315 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-4624 |
vulnerable | 2026-06-08 06:50:18.300203 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-4449 |
vulnerable | 2026-06-08 06:50:17.780058 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-4448 |
vulnerable | 2026-06-08 06:50:17.779564 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-4275 |
vulnerable | 2026-06-08 06:50:17.415489 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-4156 |
vulnerable | 2026-06-08 06:50:17.121041 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-4003 |
vulnerable | 2026-06-08 06:50:16.739556 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-3733 |
vulnerable | 2026-06-08 06:43:51.334688 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-3728 |
vulnerable | 2026-06-08 06:43:51.318808 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-3333 |
vulnerable | 2026-06-08 06:41:52.979228 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-3018 |
vulnerable | 2026-06-08 06:41:52.220053 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-2974 |
vulnerable | 2026-06-08 06:35:27.878107 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-2650 |
vulnerable | 2026-06-08 06:33:31.720136 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-2623 |
vulnerable | 2026-06-08 06:33:31.660235 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-1537 |
vulnerable | 2026-06-08 06:27:13.307481 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-1536 |
vulnerable | 2026-06-08 06:27:13.304824 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-1276 |
vulnerable | 2026-06-08 06:25:39.715824 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-1236 |
vulnerable | 2026-06-08 06:25:39.635372 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-1172 |
vulnerable | 2026-06-08 06:25:39.453120 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-1171 |
vulnerable | 2026-06-08 06:25:39.450272 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-0954 |
vulnerable | 2026-06-08 06:22:03.205309 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-0586 |
vulnerable | 2026-06-08 06:22:01.416027 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-0585 |
vulnerable | 2026-06-08 06:22:01.415598 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-7044 |
vulnerable | 2026-06-08 06:21:56.853484 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-3779 |
vulnerable | 2026-06-08 06:09:40.533549 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-4447 |
vulnerable | 2026-06-08 05:38:09.464222 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-4446 |
vulnerable | 2026-06-08 05:38:09.461508 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.