Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-07
Ultimate Store Kit - Security Vulnerability (CVE-2026-119502)
Missing Authorization vulnerability in BdThemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Store Kit Elementor Addons: from n/a through 4.0.1.
PLUGIN
Ultimate Store Kit
CVE-2026-119502
Risk Score
Threat Entry
Updated 2026-09-18
Ultimate Store Kit - Security Vulnerability (CVE-2026-92991)
The Biggop Library is vulnerable to Cross-Site Scripting via the ‘display_id’ parameter from the Sigmative API in various versions due to insufficient output escaping. This makes it possible for attackers who can compromise the Sigmative API server to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Ultimate Store Kit
CVE-2026-92991
Risk Score
Threat Entry
Updated 2026-06-17
Ultimate Store Kit - Cross-Site Request Forgery (CSRF) (CVE-2025-2168)
The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.1. This is due to missing or incorrect nonce validation on the dismiss() function. This makes it possible for unauthenticated attackers to set arbitrary user meta values to `1` which can be leveraged to lock and administrator out of their site via a forged request granted they can trick a site administrator into performing an…
PLUGIN
Ultimate Store Kit
CVE-2025-2168
Risk Score
Threat Entry
Updated 2026-06-17
Ultimate Store Kit - PHP Object Injection (CVE-2024-8030)
The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin is vulnerable to PHP Object Injection via deserialization of untrusted input via the _ultimate_store_kit_wishlist cookie in versions up to , and including, 2.0.3. This makes it possible for an unauthenticated attacker to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker or above to…
PLUGIN
Ultimate Store Kit
CVE-2024-8030
Risk Score
Threat Entry
Updated 2026-06-17
Ultimate Store Kit - PHP Object Injection (CVE-2024-5335)
The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin is vulnerable to PHP Object Injection via deserialization of untrusted input via the _ultimate_store_kit_compare_products cookie in versions up to , and including, 1.6.4. This makes it possible for an unauthenticated attacker to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker or above to…
PLUGIN
Ultimate Store Kit
CVE-2024-5335
Risk Score
Threat Entry
Updated 2026-06-17
Ultimate Store Kit - Cross-Site Scripting (XSS) (CVE-2024-43342)
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BdThemes Ultimate Store Kit Elementor Addons allows Stored XSS.This issue affects Ultimate Store Kit Elementor Addons: from n/a through 1.6.4.
PLUGIN
Ultimate Store Kit
CVE-2024-43342
Risk Score