Medium
CVE-2026-14855
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,089
Reset filters
Medium
CVE-2026-66574
Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons <= 8.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-66575
King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder <= 51.1.81 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-66576
JetBlocks for Elementor <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-66608
Unlimited Elements For Elementor <= 2.0.19 - Authenticated (Contributor+) Server-Side Request Forgery
Medium
CVE-2026-66626
SKT Addons for Elementor <= 4.0 - Authenticated (Editor+) SQL Injection
Medium
CVE-2026-84902
King Addons for Elementor <= 51.1.80 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-84903
King Addons for Elementor <= 51.1.80 - Authenticated (Contributor+) Information Exposure
Medium
CVE-2026-84904
King Addons for Elementor 51.1.56 - 51.1.80 - Missing Authorization
Medium
CVE-2026-91015
Master Addons for Elementor <= 3.1.8 - Missing Authorization
Medium
CVE-2026-86788
HT Mega 3.2.0 - 3.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-85575
The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shopengine_product_title_header_size' Parameter
High
CVE-2026-13407
Royal Elementor Addons <= 1.7.1066 - Unauthenticated Arbitrary HTML Injection in Notification Emails
Medium
CVE-2026-84088
Xpro Elementor Addons <= 1.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-62089
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits <= 3.2.2 - Missing Authorization
Medium
CVE-2026-62109
Sky Addons for Elementor <= 3.8.4 - Authenticated (Editor+) SQL Injection
Medium
CVE-2026-17585
Royal Addons for Elementor <= 1.7.1066 - Unauthenticated Sensitive Information Exposure via Unfiltered meta_query LIKE Oracle in 'wpr_keyword' Parameter
Medium
CVE-2026-10148
Booking for Appointments and Events Calendar – Amelia <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'load_manually' Parameter
Medium
CVE-2026-77150
Unlimited Elements For Elementor <= 2.0.16 - Reflected Cross-Site Scripting
High
CVE-2026-18561
Unlimited Elements For Elementor <= 2.0.16 - Unauthenticated SQL Injection
Medium
CVE-2026-62133
RTMKit <= 2.1.5 - Cross-Site Request Forgery
Medium
CVE-2026-62134
Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg <= 4.7.5 - Authenticated (Contributor+) Insecure Direct Object Reference
Critical
CVE-2026-18351
Drag and Drop File Upload for Elementor Forms <= 1.6.0 - Unauthenticated Arbitrary File Upload via 'type' Parameter
Medium
CVE-2026-83541
Sina Extension for Elementor 3.7.1 - 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.