CVE-2026-15420Nexter Blocks <= 5.0.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary CSS/JS File Deletion via 'plus_name' Parameter Exploitation status Not known exploited Fix Affected product N Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder Published 07/24/2026 Severity Medium CVE-2026-15285The Plus Addons for Elementor <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes Exploitation status Not known exploited Fix Affected product T The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Published 07/10/2026 Severity Medium CVE-2026-6740Nexter Blocks <= 4.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'commentIcon' Block Attribute Exploitation status Not known exploited Fix Affected product N Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder Published 07/08/2026 Severity Medium CVE-2026-9243The Plus Addons for Elementor <= 6.4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'carousel_direction' Parameter Exploitation status Not known exploited Fix Affected product T The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Published 05/29/2026 Severity Medium CVE-2026-5243The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Lite Widget Exploitation status Not known exploited Fix Affected product T The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Published 05/14/2026 Severity Medium CVE-2026-3311The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar Exploitation status Not known exploited Fix Affected product T The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Published 04/08/2026 Severity Medium CVE-2026-2385The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Unauthenticated Email Relay Exploitation status Not known exploited Fix Affected product T The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Published 02/22/2026 Severity Medium CVE-2026-2386The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Incorrect Authorization to Authenticated (Author+) Arbitrary Draft Post Creation via 'post_type' Exploitation status Not known exploited Fix Affected product T The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Published 02/18/2026 Severity Medium CVE-2026-0726Nexter Extension – Site Enhancements Toolkit <= 4.4.6 - Unauthenticated PHP Object Injection via 'nxt_unserialize_replace' Exploitation status Not known exploited Fix Affected product N Nexter Extension – Security, Performance, Code Snippets & Site Toolkit Published 01/20/2026 Severity High CVE-2025-13731Nexter Extension <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Exploitation status Not known exploited Fix Affected product N Nexter Extension – Security, Performance, Code Snippets & Site Toolkit Published 12/02/2025 Severity Medium CVE-2025-9029WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder <= 1.2.16 - Missing Authentication via wdkit_handle_review_submission Function Exploitation status Not known exploited Fix Affected product W WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder Published 10/04/2025 Severity Medium CVE-2025-8567Nexter Blocks <= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets Exploitation status Not known exploited Fix Affected product N Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder Published 08/19/2025 Severity Medium CVE-2025-7646The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product T The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Published 08/01/2025 Severity Medium CVE-2024-12189WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product W WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder Published 04/01/2025 Severity Medium CVE-2025-1287The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets Exploitation status Not known exploited Fix Affected product T The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Published 03/08/2025 Severity Medium CVE-2024-11829The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product T The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Published 02/01/2025 Severity Medium CVE-2024-5020Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library Exploitation status Not known exploited Fix Affected product N Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder Published 12/04/2024 Severity Medium CVE-2024-10365The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.0.3 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates Exploitation status Not known exploited Fix Affected product T The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Published 11/20/2024 Severity Medium CVE-2024-8913The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.11 - Authenticated (Contributor+) Sensitive Information Exposure via content_template Exploitation status Not known exploited Fix Affected product T The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Published 10/11/2024 Severity Medium CVE-2024-5583The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonials Widget Settings Exploitation status Not known exploited Fix Affected product T The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Published 08/22/2024 Severity Medium CVE-2024-6575The Plus Addons for Elementor <= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via TP Page Scroll Widget Exploitation status Not known exploited Fix Affected product T The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Published 08/20/2024 Severity Medium CVE-2024-5763The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Widget Exploitation status Not known exploited Fix Affected product T The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Published 08/20/2024 Severity Medium CVE-2024-4482The Plus Addons for Elementor <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget Exploitation status Not known exploited Fix Affected product T The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Published 07/03/2024 Severity Medium CVE-2024-4983The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.0- Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product T The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Published 06/27/2024 Severity Medium CVE-2024-5455The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.6 - Authenticated (Contributor+) Local File Inclusion Exploitation status Not known exploited Fix Affected product T The Plus Addons for Elementor Page Builder Pro Published 06/21/2024 Severity High CVE-2024-5344The Plus Addons for Elementor Page Builder <= 5.5.6 - Reflected Cross-Site Scripting via WP Login and Register Widget Exploitation status Not known exploited Fix Affected product T The Plus Addons for Elementor Page Builder Pro Published 06/21/2024 Severity Medium CVE-2024-5341The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading Title Widget Exploitation status Not known exploited Fix Affected product T The Plus Addons for Elementor Page Builder Pro Published 05/30/2024 Severity Medium CVE-2024-4484The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product T The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Published 05/24/2024 Severity Medium CVE-2024-4485The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product T The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Published 05/24/2024 Severity Medium CVE-2024-3718The Plus Addons for Elementor <= 5.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar, Header Meta Content, Scroll Navigation, Pricing Table, & Flip Box Exploitation status Not known exploited Fix Affected product T The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Published 05/24/2024 Severity Medium CVE-2024-2784The Plus Addons for Elementor <= 5.5.4 - Authenticated (Contibutor+) Stored Cross-Site Scripting via Hover Card Exploitation status Not known exploited Fix Affected product T The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Published 05/24/2024 Severity Medium CVE-2024-2785The Plus Addons for Elementor <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Age Gate Exploitation status Not known exploited Fix Affected product T The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Published 05/09/2024 Severity Medium CVE-2024-0445The Plus Addons for Elementor <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product T The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Published 05/09/2024 Severity Medium CVE-2024-3197The Plus Addons for Elementor <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes Exploitation status Not known exploited Fix Affected product T The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Published 05/02/2024 Severity Medium CVE-2024-3199The Plus Addons for Elementor <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget Exploitation status Not known exploited Fix Affected product T The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Published 05/02/2024 Severity Medium CVE-2024-2203The Plus Addons for Elementor <= 5.4.1 - Authenticated (Contributor+) Local File Inclusion via Clients Widget Exploitation status Not known exploited Fix Affected product T The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Published 03/27/2024 Severity Medium CVE-2024-2210The Plus Addons for Elementor <= 5.4.1 - Authenticated (Contributor+) Local File Inclusion via Team Member Listing Exploitation status Not known exploited Fix Affected product T The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Published 03/27/2024 Severity Medium CVE-2024-1419The Plus Addons for Elementor <= 5.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Header Meta Content Widget Exploitation status Not known exploited Fix Affected product T The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Published 03/07/2024 Severity Medium CVE-2023-45657WordPress Nexter Theme <= 2.0.3 is vulnerable to SQL Injection Exploitation status Not known exploited Fix Affected product N Nexter Published 11/06/2023 Severity Critical CVE-2021-4332The Plus Addons for Elementor PRO <= 4.1.9 & The Plus Addons for Elementor <= 2.0.6 - Authenticated (Contributor+) Arbitrary File Read Exploitation status Not known exploited Fix Affected product T The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Published 03/07/2023 Severity Medium CVE-2021-4331The Plus Addons for Elementor PRO <= 4.1.9 & The Plus Addons for Elementor <= 2.0.6 - Authenticated (Contributor+) Privilege Escalation Exploitation status Not known exploited Fix Affected product T The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Published 03/07/2023 Severity High 
