Browse 1,539+ CVEs from NVD & CNNVD with AI-powered analysis, AI-generated PoCs, KEV/EPSS tracking, and daily security intelligence. Filter by vendor, product, severity, or CWE.
| CVE ID | Title | Vendor | Product | Severity | CVSS Score | Published At | AI Analysis |
|---|---|---|---|---|---|---|---|
| CVE-2026-45443 | WordPress PDF for Elementor Forms + Drag And Drop Template Builder plugin <= 5.5.1 - Broken Access Control vulnerability | ADD-ONS.ORG | PDF for Elementor Forms + Drag And Drop Template Builder | Medium | 5.0 | 2026-05-20 12:11:50 | Deep Dive |
| CVE-2025-15369 | Xpro Addons — 140+ Widgets for Elementor <= 1.5.0 - Missing Authorization to Unauthenticated Xpro Template Creation | xpro | Xpro Addons — 140+ Widgets for Elementor | Medium | 5.3 | 2026-05-20 02:27:48 | Deep Dive |
| CVE-2026-7284 | Easy Elements for Elementor <= 1.4.4 - Unauthenticated Privilege Escalation via easyel_handle_register | themewant | Easy Elements for Elementor – Addons & Website Templates | Critical | 9.8 | 2026-05-20 01:25:47 | Deep Dive |
| CVE-2026-4885 | Piotnet Addons for Elementor Pro <= 7.1.70 - Unauthenticated Arbitrary File Upload via Form File Upload | Piotnet | Piotnet Addons For Elementor Pro | Critical | 9.8 | 2026-05-19 06:46:46 | Deep Dive |
| CVE-2026-6504 | Royal Addons for Elementor <= 1.7.1058 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Parameter | wproyal | Royal Addons for Elementor – Addons and Templates Kit for Elementor | Medium | 6.4 | 2026-05-14 08:24:28 | Deep Dive |
| CVE-2026-5193 | Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.5.13 - Authenticated (Author+) Limited Privilege Escalation via register_user | wpdevteam | Essential Addons for Elementor – Popular Elementor Templates & Widgets | Medium | 6.5 | 2026-05-14 06:44:10 | Deep Dive |
| CVE-2026-5243 | The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Lite Widget | posimyththemes | The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce | Medium | 6.4 | 2026-05-14 05:30:28 | Deep Dive |
| CVE-2026-5486 | Unlimited Elements For Elementor <= 2.0.7 - Authenticated (Contributor+) SQL Injection via 'filter_search' Parameter | unitecms | Unlimited Elements For Elementor | Medium | 6.5 | 2026-05-14 02:26:40 | Deep Dive |
| CVE-2026-45214 | WordPress Xpro Elementor Addons plugin <= 1.5.1 - SQL Injection vulnerability | Xpro | Xpro Elementor Addons | High | 8.5 | 2026-05-12 11:02:10 | Deep Dive |
| CVE-2026-7475 | Sky Addons <= 3.3.2 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Script | wowdevs | Sky Addons – Elementor Addons with Widgets & Templates | Medium | 6.4 | 2026-05-08 09:26:48 | Deep Dive |
| CVE-2026-25468 | WordPress Happy Addons for Elementor plugin <= 3.20.8 - Sensitive Data Exposure vulnerability | weDevs | Happy Addons for Elementor | Medium | 5.3 | 2026-05-07 07:37:59 | Deep Dive |
| CVE-2026-25436 | WordPress Royal Elementor Addons plugin < 1.7.1053 - Broken Access Control vulnerability | WProyal | Royal Elementor Addons | Medium | 5.3 | 2026-05-07 07:34:02 | Deep Dive |
| CVE-2026-27421 | WordPress Royal Elementor Addons plugin < 1.7.1053 - Cross Site Scripting (XSS) vulnerability | WProyal | Royal Elementor Addons | Medium | 6.5 | 2026-05-07 07:31:53 | Deep Dive |
| CVE-2026-4362 | ElementsKit Elementor Addons <= 3.8.2 - Missing Authorization to Unauthenticated Widget Content Overwrite | roxnor | ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor | Medium | 6.5 | 2026-05-05 04:27:56 | Deep Dive |
| CVE-2026-5159 | Royal Addons for Elementor <= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Follow Button Text' Parameter | wproyal | Royal Addons for Elementor – Addons and Templates Kit for Elementor | Medium | 6.4 | 2026-05-05 03:37:40 | Deep Dive |
| CVE-2026-4803 | Royal Addons for Elementor <= 1.7.1056 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter in wpr_update_form_action_meta | wproyal | Royal Addons for Elementor – Addons and Templates Kit for Elementor | High | 7.2 | 2026-05-05 03:37:39 | Deep Dive |
| CVE-2026-4790 | Premium Addons for Elementor <= 4.11.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_svg' Parameter | leap13 | Premium Addons for Elementor – Powerful Elementor Templates & Widgets | Medium | 5.4 | 2026-05-02 11:16:11 | Deep Dive |
| CVE-2026-4024 | Royal Addons for Elementor <= 1.7.1056 - Missing Authorization to Unauthenticated Form Action Meta Modification | wproyal | Royal Addons for Elementor – Addons and Templates Kit for Elementor | Medium | 5.3 | 2026-05-02 08:27:05 | Deep Dive |
| CVE-2026-6229 | Royal Addons for Elementor <= 1.7.1057 - Authenticated (Contributor+) Server-Side Request Forgery via CSV URL Parameter | wproyal | Royal Addons for Elementor – Addons and Templates Kit for Elementor | High | 7.2 | 2026-05-02 07:46:42 | Deep Dive |
| CVE-2026-6916 | Jeg Kit for Elementor <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg_content_number_prefix' Shortcode Attribute | jegtheme | Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress | Medium | 6.4 | 2026-05-02 05:29:28 | Deep Dive |