GCVE - cpe:2.3:a:kraftplugins:mega_elements:*:*:*:*:*:wordpress:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:kraftplugins:mega_elements:*:*:*:*:*:wordpress:*:*

part: a version: * update: *

Vendor	Kraftplugins (`bd8ffecd-a4dd-5b95-92ee-a12c2e04763d`)
Product	Mega Elements (`89386de2-f08e-5310-914b-c1a1b165445d`)
Edition	*
Language	*
Software edition	*
Target software	wordpress
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-4702`	vulnerable	2026-06-08 06:50:18.455535	Mega Elements <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget MEDIUM (6.4) The Mega Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button widget in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Published: 2024-05-15T11:33:08.241Z Updated: 2026-04-08T16:46:26.703Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/3808ca2a-e78e-4118-890b-c22a71f8e855?source=cve https://plugins.trac.wordpress.org/changeset/3085457/mega-elements-addons-for-elementor	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-49693`	vulnerable	2026-06-08 06:50:14.537012	WordPress Mega Elements – Addons for Elementor plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability MEDIUM (6.5) Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kraft Plugins Mega Elements mega-elements-addons-for-elementor allows Stored XSS.This issue affects Mega Elements: from n/a through <= 1.2.6. Published: 2024-10-24T12:41:55.270Z Updated: 2026-04-28T16:10:27.957Z Open on db.gcve.eu Reference links https://patchstack.com/database/Wordpress/Plugin/mega-elements-addons-for-elementor/vulnerability/wordpress-mega-elements-addons-for-elementor-plugin-1-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-37466`	vulnerable	2026-06-08 06:39:47.648879	WordPress Mega Elements plugin <= 1.2.2 - Contributor+ Cross Site Scripting (XSS) vulnerability MEDIUM (6.5) Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kraftplugins Mega Elements.This issue affects Mega Elements: from n/a through 1.2.2. Published: 2024-07-21T21:22:43.225Z Updated: 2026-04-28T16:09:59.499Z Open on db.gcve.eu Reference links https://patchstack.com/database/vulnerability/mega-elements-addons-for-elementor/wordpress-mega-elements-plugin-1-2-2-contributor-cross-site-scripting-xss-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-32575`	vulnerable	2026-06-08 06:37:23.225193	WordPress Mega Elements plugin <= 1.1.9 - Cross Site Scripting (XSS) vulnerability MEDIUM (6.5) Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kraftplugins Mega Elements allows Stored XSS.This issue affects Mega Elements: from n/a through 1.1.9. Published: 2024-04-18T09:35:44.581Z Updated: 2026-04-28T16:09:37.632Z Open on db.gcve.eu Reference links https://patchstack.com/database/vulnerability/mega-elements-addons-for-elementor/wordpress-mega-elements-plugin-1-1-9-cross-site-scripting-xss-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.