Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-13345— Essential Addons for Elementor - Lite < 6.6.10 - Unauthenticated Draft/Private WooCommerce Product Disclosure via Compare Table

AI Predicted 7.5 Difficulty: Easy EPSS 0.24% · P16

Affected Version Matrix 1

VendorProductVersion RangeStatus
UnknownEssential Addons for Elementor< 6.6.10affected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-13345

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Essential Addons for Elementor - Lite < 6.6.10 - Unauthenticated Draft/Private WooCommerce Product Disclosure via Compare Table
Source: CVE Program / CVE List V5
Vulnerability Description
The Essential Addons for Elementor WordPress plugin before 6.6.10 does not perform authorization, status, or visibility checks when resolving WooCommerce products in its product-comparison feature, allowing unauthenticated users to disclose the title, price, and SKU of draft, pending, and private products that are otherwise withheld from public view.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress Essential Addons for Elementor 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress Essential Addons for Elementor是WordPress基金会的一款提升Elementor功能的扩展插件集合。 WordPress Essential Addons for Elementor 6.6.10之前版本存在授权问题漏洞，该漏洞源于产品比较功能中未执行授权、状态或可见性检查，导致未认证用户可泄露草稿、待定和私有产品的标题、价格和SKU。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
UnknownEssential Addons for Elementor 0 ~ 6.6.10 -

II. Public POCs for CVE-2026-13345

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-13345

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-13345 (1)

Same Patch Batch · Unknown · 2026-07-30 · 36 CVEs total

CVE-2026-13143WP Travel < 11.8.1 - Unauthenticated Payment Bypass via Forged PayPal IPN
CVE-2026-15257RegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission and User Profile Modificatio
CVE-2026-15240Customer Switching for WooCommerce < 2.1.3 - Customer+ Privilege Escalation to Administrat
CVE-2026-15382Ultimate Addons for WPBakery Page Builder < 3.21.4 - Unauthenticated Custom Icon Font Dele
CVE-2026-11870Hide My WP Ghost < 7.0.05 - IP Address Spoofing via Trusted Proxy Headers Leading to Prote
CVE-2026-11867Frontend Admin by DynamiApps < 3.29.7 - Subscriber+ Taxonomy Term Creation/Modification/De
CVE-2026-11881Fluent Forms < 6.2.6 - Contributor+ Stored XSS via Date/Time Field
CVE-2026-11782Points and Rewards for WooCommerce < 2.10.1 - Unauthenticated Arbitrary User Wallet & Poin
CVE-2026-12500WP Travel Engine < 6.8.2 - Unauthenticated Trip Difficulty Level Option Update
CVE-2026-15255RegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission Disclosure via IDOR
CVE-2026-13145WP Travel < 11.8.1 - Subscriber+ Booking PII Disclosure via IDOR
CVE-2026-13344Essential Addons for Elementor - Lite < 6.6.10 - Contributor+ Stored XSS via Pricing Table
CVE-2026-13330Animation Addons for Elementor < 2.7.0 - Author+ Stored XSS via SVG Upload
CVE-2026-13178Eventin < 4.1.16 - Unauthenticated Payment Bypass via Order Status Manipulation
CVE-2026-13395Bookly < 27.8 - Unauthenticated SQL Injection via staff_id
CVE-2026-14310Tutor LMS < 4.0.0 - Subscriber+ Cross-Course Q&A Content Disclosure and Reply Injection
CVE-2026-14239Tourmaster < 5.4.8 - Stored XSS via CSRF
CVE-2026-14305WP Delicious < 1.10.2 - Unauthenticated Arbitrary Post Meta Update via recipe_likes
CVE-2026-15235Hotel Booking Lite < 6.0.4 - Subscriber+ Sensitive Data Disclosure via Admin Calendar AJAX
CVE-2026-14188Easy Appointments <= 3.12.26 - Contributor+ Customer Data Disclosure

Showing top 20 of 36 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Essential Addons for Elementor
Same vendor: Unknown

V. Comments for CVE-2026-13345

No comments yet

Leave a comment