Filtered by vendor Wpdevteam Subscriptions
Filtered by product Essential Addons For Elementor Subscriptions

Search

Switch to Advanced Search (Beta)
Total 5 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-18039 2 Wordpress, Wpdevteam 2 Wordpress, Essential Addons For Elementor 2026-08-14 8.1 High
The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration fields from overwriting reserved account attributes, allowing unauthenticated attackers to register an account with an arbitrary role, including administrator, on sites where a custom profile field with a particular label has been configured.
CVE-2026-13345 2 Wordpress, Wpdevteam 2 Wordpress, Essential Addons For Elementor 2026-07-30 5.3 Medium
The Essential Addons for Elementor WordPress plugin before 6.6.10 does not perform authorization, status, or visibility checks when resolving WooCommerce products in its product-comparison feature, allowing unauthenticated users to disclose the title, price, and SKU of draft, pending, and private products that are otherwise withheld from public view.
CVE-2026-13344 2 Wordpress, Wpdevteam 2 Wordpress, Essential Addons For Elementor 2026-07-30 4.8 Medium
The Essential Addons for Elementor WordPress plugin before 6.6.10 does not validate the HTML tag name of the Pricing Table widget title before outputting it, allowing users with Contributor-level access and above to inject JavaScript that will be executed (Stored Cross-Site Scripting) when the page is viewed, including in the session of an administrator previewing or visiting the post.
CVE-2025-13977 3 Elementor, Wordpress, Wpdevteam 3 Elementor, Wordpress, Essential Addons For Elementor 2026-04-21 6.4 Medium
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple attack vectors in all versions up to, and including, 6.5.3. This is due to insufficient input sanitization and output escaping in the Event Calendar widget's custom attributes handling and the Image Masking module's element ID rendering. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-1004 2 Wordpress, Wpdevteam 2 Wordpress, Essential Addons For Elementor 2026-04-16 5.3 Medium
The Essential Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 6.5.5 via the 'eael_product_quickview_popup' function. This makes it possible for unauthenticated attackers to retrieve WooCommerce product information for products with draft, pending, or private status, which should normally be restricted.