sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total40,783
Critical3,170
High11,980
Medium25,054
Reset
Showing 2161-2180 of 40783 records
Threat Entry Updated 2026-10-01

Unlimited Elements For Elementor - Security Vulnerability (CVE-2026-103338)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.

PLUGIN Unlimited Elements For Elementor

CVE-2026-103338

HIGH CVSS 8.5 2026-10-01
Open Full Technical Breakdown
Threat Entry Updated 2026-10-01

Elementskit Lite - Security Vulnerability (CVE-2026-103064)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ElementsKit Elementor addons Lite elementskit-lite allows Stored XSS.This issue affects ElementsKit Elementor addons Lite: from n/a through 4.0.6.

PLUGIN Elementskit Lite

CVE-2026-103064

MEDIUM CVSS 6.5 2026-10-01
Open Full Technical Breakdown
Threat Entry Updated 2026-10-01

Unlimited Elements For Elementor - Security Vulnerability (CVE-2026-103341)

Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.

PLUGIN Unlimited Elements For Elementor

CVE-2026-103341

MEDIUM CVSS 5.3 2026-10-01
Open Full Technical Breakdown
Threat Entry Updated 2026-10-01

Woo Product Builder - Security Vulnerability (CVE-2026-102379)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Blind SQL Injection.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC Builder: from n/a through 1.0.28.

PLUGIN Woo Product Builder

CVE-2026-102379

HIGH CVSS 8.5 2026-10-01
Open Full Technical Breakdown
Threat Entry Updated 2026-10-01

Elementskit Lite - Security Vulnerability (CVE-2026-103063)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ElementsKit Elementor addons Lite elementskit-lite allows Stored XSS.This issue affects ElementsKit Elementor addons Lite: from n/a through 4.0.6.

PLUGIN Elementskit Lite

CVE-2026-103063

MEDIUM CVSS 6.5 2026-10-01
Open Full Technical Breakdown
Threat Entry Updated 2026-10-01

Essential Addons For Elementor Lite - Security Vulnerability (CVE-2026-102394)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through 6.8.4.

PLUGIN Essential Addons For Elementor Lite

CVE-2026-102394

MEDIUM CVSS 6.5 2026-10-01
Open Full Technical Breakdown
Threat Entry Updated 2026-10-01

Affi Affiliate Marketing For Woo - Security Vulnerability (CVE-2026-102390)

Missing Authorization vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.9.

PLUGIN Affi Affiliate Marketing For Woo

CVE-2026-102390

MEDIUM CVSS 5.3 2026-10-01
Open Full Technical Breakdown
Threat Entry Updated 2026-10-01

Majestic Support - Security Vulnerability (CVE-2026-102382)

Authorization Bypass Through User-Controlled Key vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through 1.2.0.

PLUGIN Majestic Support

CVE-2026-102382

MEDIUM CVSS 4.3 2026-10-01
Open Full Technical Breakdown
Threat Entry Updated 2026-10-01

Forminator Forms - Security Vulnerability (CVE-2026-92144)

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The required form submission nonce is freely obtainable by unauthenticated users via the publicly accessible wp_ajax_nopriv_forminator_get_nonce endpoint, making the full attack chain exploitable without any authentication…

PLUGIN Forminator Forms

CVE-2026-92144

HIGH CVSS 7.2 2026-10-01
Open Full Technical Breakdown
Threat Entry Updated 2026-10-03

Essential Blocks - Security Vulnerability (CVE-2026-96256)

The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Map block's 'marker' attribute in versions up to, and including, 6.4.5 This is due to insufficient input sanitization and output escaping on marker title/content values, which are stored as JSON and then decoded and concatenated directly into raw HTML by the frontend script's InfoWindow content builder. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that…

PLUGIN Essential Blocks

CVE-2026-96256

MEDIUM CVSS 6.4 2026-10-01
Open Full Technical Breakdown
Threat Entry Updated 2026-10-01

Cf7 Redirect Thank You Page - Security Vulnerability (CVE-2026-97661)

The Business Essentials for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gateway' Form Field in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Payments module to be enabled and a form to be configured to accept both PayPal and Stripe as payment gateways.

PLUGIN Cf7 Redirect Thank You Page

CVE-2026-97661

HIGH CVSS 7.2 2026-10-01
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.