Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-10-30
The Plus Addons For Elementor Page Builder - Security Vulnerability (CVE-2026-116848)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH Innovations The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder allows Stored XSS.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through 6.5.3.
PLUGIN
The Plus Addons For Elementor Page Builder
CVE-2026-116848
Risk Score
Threat Entry
Updated 2026-09-30
The Plus Addons For Elementor Page Builder - Security Vulnerability (CVE-2026-96829)
Contributor Cross Site Scripting (XSS) in The Plus Addons for Elementor Page Builder Lite
PLUGIN
The Plus Addons For Elementor Page Builder
CVE-2026-96829
Risk Score
Threat Entry
Updated 2026-06-17
The Plus Addons For Elementor Page Builder - Broken Access Control (CVE-2026-2386)
The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 6.4.7. This is due to the tpae_create_page() AJAX handler authorizing users only with current_user_can('edit_posts') while accepting a user-controlled 'post_type' value passed directly to wp_insert_post() without post-type-specific capability checks. This makes it possible for authenticated attackers, with Author-level access and above, to create arbitrary draft posts for restricted post types (e.g., 'page' and 'nxt_builder') via the 'post_type' parameter.
PLUGIN
The Plus Addons For Elementor Page Builder
CVE-2026-2386
Risk Score
Threat Entry
Updated 2026-06-17
Plus Addons for Elementor Page Builder - Path Traversal (CVE-2024-5455)
The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.5.4 via the 'magazine_style' parameter within the Dynamic Smart Showcase widget. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can…
PLUGIN
Plus Addons for Elementor Page Builder
CVE-2024-5455
Risk Score
Threat Entry
Updated 2026-06-17
The Plus Addons for Elementor Page Builder - Cross-Site Scripting (XSS) (CVE-2024-5344)
The The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘forgoturl’ attribute within the plugin's WP Login & Register widget in all versions up to, and including, 5.5.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
The Plus Addons for Elementor Page Builder
CVE-2024-5344
Risk Score
Threat Entry
Updated 2026-06-17
The Plus Addons for Elementor Page Builder - Cross-Site Scripting (XSS) (CVE-2024-5341)
The The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'size' attribute of the Heading Title widget in all versions up to, and including, 5.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
The Plus Addons for Elementor Page Builder
CVE-2024-5341
Risk Score
Threat Entry
Updated 2026-06-17
Plus Addons for Elementor Page Builder - Open Redirect (CVE-2021-24358)
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.10 did not validate a redirect parameter on a specifically crafted URL before redirecting the user to it, leading to an Open Redirect issue.
PLUGIN
Plus Addons for Elementor Page Builder
CVE-2021-24358
Risk Score
Threat Entry
Updated 2026-06-17
Plus Addons for Elementor Page Builder - Open Redirect (CVE-2021-24359)
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.11 did not properly check that a user requesting a password reset was the legitimate user, allowing an attacker to send an arbitrary reset password email to a registered user on behalf of the WordPress site. Such issue could be chained with an open redirect (CVE-2021-24358) in version below 4.1.10, to include a crafted password reset link in the email, which would lead to an account takeover.
PLUGIN
Plus Addons for Elementor Page Builder
CVE-2021-24359
Risk Score
Threat Entry
Updated 2026-06-17
Plus Addons for Elementor Page Builder - Security Vulnerability (CVE-2021-24175)
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.7 was being actively exploited to by malicious actors to bypass authentication, allowing unauthenticated users to log in as any user (including admin) by just providing the related username, as well as create accounts with arbitrary roles, such as admin. These issues can be exploited even if registration is disabled, and the Login widget is not active.
PLUGIN
Plus Addons for Elementor Page Builder
CVE-2021-24175
Risk Score