CVE-2026-75980BetterDocs <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content Exploitation status Not known exploited Fix Affected product B BetterDocs – AI Documentation, Knowledge Base, MCP Server, Docs, Wikis, FAQ & Chatbot Published 09/01/2026 Severity Medium CVE-2026-19801BetterLinks <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Short URL Creation via create_fbs_link AJAX Action Exploitation status Not known exploited Fix Affected product B BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP Published 08/25/2026 Severity Medium CVE-2026-18438Templately <= 3.7.1 - Authenticated (Contributor+) Arbitrary File Upload to Remote Code Execution via Gutenberg Cloud Import Attachment Filename Mismatch Exploitation status Not known exploited Fix Affected product T Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! Published 08/15/2026 Severity High CVE-2026-15145Essential Addons for Elementor <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 07/21/2026 Severity Medium CVE-2026-15156Essential Addons for Elementor <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Reading Progress Global Color Settings Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 07/21/2026 Severity Medium CVE-2026-15155Essential Addons for Elementor <= 6.6.10 - Authenticated (Contributor+) Account Takeover via Email Header Injection Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 07/11/2026 Severity High CVE-2026-15104BetterDocs <= 4.6.0 - Authenticated (Custom+) SQL Injection via 'lang' Parameter Exploitation status Not known exploited Fix Affected product B BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot Published 07/10/2026 Severity Medium CVE-2026-6459Essential Addons for Elementor <= 6.6.2 - Authenticated (Author+) Stored Cross-Site Scripting via Event Calendar Widget Popup Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 07/08/2026 Severity Medium CVE-2026-10833Gutenberg Essential Blocks - Page Builder for Gutenberg Blocks & Patterns <= 6.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'configurablePrefix' Block Attribute Exploitation status Not known exploited Fix Affected product G Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns Published 06/25/2026 Severity Medium CVE-2026-12157BetterDocs <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'blockId' Block Attribute Exploitation status Not known exploited Fix Affected product B BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot Published 06/19/2026 Severity Medium CVE-2026-7796EmbedPress <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block 'url' Attribute Exploitation status Not known exploited Fix Affected product E EmbedPress – PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more Published 06/06/2026 Severity Medium CVE-2026-7665Essential Addons for Elementor <= 6.6.4 - Missing Authorization to Unauthenticated Information Exposure via 'load_more' AJAX Handler Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 06/06/2026 Severity Medium CVE-2026-10586Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns <= 6.1.3 - Authenticated (Author+) Server-Side Request Forgery Exploitation status Not known exploited Fix Affected product G Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns Published 06/04/2026 Severity High CVE-2026-5193Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.5.13 - Authenticated (Author+) Limited Privilege Escalation via register_user Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 05/14/2026 Severity Medium CVE-2026-4658Gutenberg Essential Blocks <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes Exploitation status Not known exploited Fix Affected product G Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns Published 05/02/2026 Severity Medium CVE-2026-6393BetterDocs <= 4.3.11 - Missing Authorization to Authenticated (Subscriber+) Unauthorized AI API Usage Exploitation status Not known exploited Fix Affected product B BetterDocs – Knowledge Base Docs & FAQ Solution for Elementor & Block Editor Published 04/24/2026 Severity Medium CVE-2026-3875BetterDocs <= 4.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Exploitation status Not known exploited Fix Affected product B BetterDocs – Knowledge Base Docs & FAQ Solution for Elementor & Block Editor Published 04/16/2026 Severity Medium CVE-2026-1512Essential Addons for Elementor <= 6.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box Widget Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 02/14/2026 Severity Medium CVE-2026-0554NotificationX <= 3.1.11 - Missing Authorization to Authenticated (Contributor+) Analytics Reset Exploitation status Not known exploited Fix Affected product N NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar Published 01/20/2026 Severity Medium CVE-2025-15380NotificationX <= 3.2.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'nx-preview' Exploitation status Not known exploited Fix Affected product N NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar Published 01/20/2026 Severity High CVE-2026-1004Essential Addons for Elementor <= 6.5.5 - Missing Authorization to Unauthenticated Sensitive Information Exposure Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 01/16/2026 Severity Medium CVE-2026-0831Templately <= 3.4.8 - Unauthenticated Limited Arbitrary JSON File Write Exploitation status Not known exploited Fix Affected product T Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! Published 01/10/2026 Severity Medium CVE-2025-14980BetterDocs <= 4.3.3 - Authenticated (Contributor+) Sensitive Information Exposure Exploitation status Not known exploited Fix Affected product B BetterDocs – Knowledge Base Docs & FAQ Solution for Elementor & Block Editor Published 01/09/2026 Severity Medium CVE-2025-13977Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 12/17/2025 Severity Medium CVE-2025-11369Essential Blocks <= 5.7.2 - Missing Authorization To Authenticated (Author+) Information Disclosure Exploitation status Not known exploited Fix Affected product G Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns Published 12/17/2025 Severity Medium CVE-2025-11270Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns <= 5.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product G Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns Published 10/18/2025 Severity Medium CVE-2025-11361Essential Blocks <= 5.7.1 - Authenticated (Author+) Server-Side Request Forgery Exploitation status Not known exploited Fix Affected product G Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns Published 10/18/2025 Severity Medium CVE-2025-7499BetterDocs <= 4.1.1 - Missing Authorization to Private And Password-Protected Posts Information Disclosure Exploitation status Not known exploited Fix Affected product B BetterDocs – Knowledge Base Docs & FAQ Solution for Elementor & Block Editor Published 08/16/2025 Severity Medium CVE-2025-8451Essential Addons for Elementor – Popular Elementor Templates and Widgets <= 6.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'data-gallery-items' Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 08/15/2025 Severity Medium CVE-2025-6244Essential Addons for Elementor – Popular Elementor Templates and Widgets <= 6.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via `Calendar` And `Business Reviews` Widgets Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 07/08/2025 Severity Medium CVE-2024-5647Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 07/03/2025 Severity Medium CVE-2024-9993Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 6.1.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Event Calendar Widget Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 06/07/2025 Severity Medium CVE-2024-9994Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 6.1.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Pricing Table Widget Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 06/07/2025 Severity Medium CVE-2025-4682Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 5.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider and Post Carousel Widgets Exploitation status Not known exploited Fix Affected product G Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns Published 05/27/2025 Severity Medium CVE-2025-1664Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 5.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product G Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns Published 03/08/2025 Severity Medium CVE-2024-13803Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 5.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product G Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns Published 02/26/2025 Severity Medium CVE-2024-12045Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 5.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product G Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns Published 01/08/2025 Severity Medium CVE-2024-11727NotificationX – Live Sales Notification, WooCommerce Sales Popup, FOMO, Social Proof, Announcement Banner & Floating Notification Top Bar <= 2.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product N NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar Published 12/12/2024 Severity Medium CVE-2024-11203EmbedPress – Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & Elementor <= 4.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'provider_name' Exploitation status Not known exploited Fix Affected product E EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Published 11/28/2024 Severity Medium CVE-2024-8978Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.9 - Authenticated (Contributor+) Sensitive Information Exposure Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 11/15/2024 Severity Medium CVE-2024-8979Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.9 - Authenticated (Author+) Sensitive Information Exposure to Privilege Escalation Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 11/15/2024 Severity High CVE-2024-8961Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 11/15/2024 Severity Medium CVE-2021-4447Essential Addons for Elementor <= 4.6.4 - Authenticated (Contributor+) Privilege Escalation Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 10/16/2024 Severity High CVE-2021-4446Essential Addons for Elementor <= 4.6.4 - Missing Authorization Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 10/16/2024 Severity Medium CVE-2024-8742Essential Addons for Elementor <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery Widget Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 09/13/2024 Severity Medium CVE-2024-8440Essential Addons for Elementor -- Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 09/11/2024 Severity Medium CVE-2024-7092Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via no_more_items_text Parameter Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 08/13/2024 Severity Medium CVE-2024-6557SchedulePress <= 5.1.3 - Unauthenticated Full Path Disclosure Exploitation status Not known exploited Fix Affected product S SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher Published 07/16/2024 Severity Medium CVE-2024-1565EmbedPress <= 3.9.10 - Authenticated(Contributor+) Stored Cross-Site Scripting via PDF Widget URL Exploitation status Not known exploited Fix Affected product E EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Published 06/13/2024 Severity Medium CVE-2024-5189Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.23 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 06/11/2024 Severity Medium CVE-2024-5188Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.22 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 06/06/2024 Severity Medium CVE-2024-5571EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widget Exploitation status Not known exploited Fix Affected product E EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Published 06/05/2024 Severity Medium CVE-2024-5073Essential Addons for Elementor <= 5.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Feed Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 05/30/2024 Severity Medium CVE-2024-1803EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.12 - Insufficient Authorization Checks to Block Usual Exploitation status Not known exploited Fix Affected product E EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Published 05/23/2024 Severity Medium CVE-2024-4891Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.12 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product G Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns Published 05/18/2024 Severity Medium CVE-2024-4624Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.20 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 05/14/2024 Severity Medium CVE-2024-4275Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Interactive Circles' Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 05/10/2024 Severity Medium CVE-2024-4449Essential Addons for Elementor <= 5.9.19 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Several Widgets Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 05/10/2024 Severity Medium CVE-2024-4448Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Dual Color Header', 'Event Calendar', & 'Advanced Data Table' Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 05/10/2024 Severity Medium CVE-2024-4316EmbedPress Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter Exploitation status Not known exploited Fix Affected product E EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Published 05/09/2024 Severity Medium CVE-2024-3728Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery & Interactive Circle Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 05/02/2024 Severity Medium CVE-2024-4156Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.17 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 05/02/2024 Severity Medium CVE-2024-4003Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 05/02/2024 Severity Medium CVE-2024-3733Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Information Exposure Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 04/25/2024 Severity Medium CVE-2024-3818Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.9 - Authenticated (Contributor+) DOM-Based Cross-Site Scripting via "Social Icons" Block Exploitation status Not known exploited Fix Affected product G Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns Published 04/19/2024 Severity Medium CVE-2024-3333Essential Addons for Elementor <= 5.9.14 - Authenticated (Contributor+) Store Cross-Site Scripting via Widget URL Attribute Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 04/17/2024 Severity Medium CVE-2024-2623Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 04/09/2024 Severity Medium CVE-2024-2974Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.13 - Unauthenticated Sensitive Information Exposure Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 04/09/2024 Severity Medium CVE-2024-3244EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Exploitation status Not known exploited Fix Affected product E EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Published 04/09/2024 Severity Medium CVE-2024-2650Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 04/09/2024 Severity Medium CVE-2024-2845BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg <= 3.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Exploitation status Not known exploited Fix Affected product B BetterDocs – Knowledge Base Docs & FAQ Solution for Elementor & Block Editor Published 04/09/2024 Severity Medium CVE-2024-3245EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Youtube Block Exploitation status Not known exploited Fix Affected product E EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Published 04/06/2024 Severity Medium CVE-2024-3018Essential Addons for Elementor <= 5.9.13 - Authenticated (Author+) PHP Object Injection via error_resetpassword Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 03/30/2024 Severity High CVE-2024-2468EmbedPress <= 3.9.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Widget Attribute Exploitation status Not known exploited Fix Affected product E EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Published 03/23/2024 Severity Medium CVE-2024-2688EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.12 - Authenticated (Contributor+) Stored Cross-site Scripting via 'embedpress_doc_custom_color' Exploitation status Not known exploited Fix Affected product E EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Published 03/23/2024 Severity Medium CVE-2024-2255Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product G Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns Published 03/20/2024 Severity Medium CVE-2024-1854Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product G Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns Published 03/13/2024 Severity Medium CVE-2024-1537Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 03/13/2024 Severity Medium CVE-2024-1536Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Event Calendar Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 03/13/2024 Severity High CVE-2024-1802EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Wistia Block Exploitation status Not known exploited Fix Affected product E EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Published 03/07/2024 Severity Medium CVE-2024-2128EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widget Exploitation status Not known exploited Fix Affected product E EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Published 03/07/2024 Severity Medium CVE-2024-1698NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor <= 2.8.2 - Unauthenticated SQL Injection Exploitation status Not known exploited Fix Affected product N NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar Published 02/27/2024 Severity Critical CVE-2024-1171Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 02/20/2024 Severity Medium CVE-2024-1172Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 02/20/2024 Severity Medium CVE-2024-1276Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 02/20/2024 Severity Medium CVE-2024-1349EmbedPress <= 3.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Exploitation status Not known exploited Fix Affected product E EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Published 02/20/2024 Severity Medium CVE-2024-1425EmbedPress <= 3.9.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via Google Calendar Widget Link Exploitation status Not known exploited Fix Affected product E EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Published 02/20/2024 Severity Medium CVE-2024-1236Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 02/20/2024 Severity Medium CVE-2024-0586Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.4 - Authenticated (Contributor+) Stored Cross-Site Scritping Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 02/05/2024 Severity Medium CVE-2024-0954Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 02/05/2024 Severity Medium CVE-2024-0585Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image URl Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 02/05/2024 Severity Medium CVE-2023-7071Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product G Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns Published 01/11/2024 Severity Medium CVE-2023-7044Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 01/04/2024 Severity Medium CVE-2023-6986EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor <= 3.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Exploitation status Not known exploited Fix Affected product E EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Published 01/03/2024 Severity Medium CVE-2023-4386Essential Blocks <= 4.2.0 - Unauthenticated PHP Object Injection via queries Exploitation status Not known exploited Fix Affected product E Essential Blocks Pro Published 10/20/2023 Severity High CVE-2023-4402Essential Blocks <= 4.2.0 - Unauthenticated PHP Object Injection via products Exploitation status Not known exploited Fix Affected product E Essential Blocks Pro Published 10/20/2023 Severity High CVE-2023-4283EmbedPress <= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Exploitation status Not known exploited Fix Affected product E EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Published 08/10/2023 Severity Medium CVE-2023-4282EmbedPress <= 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Delete via admin_post_remove and remove_private_data Exploitation status Not known exploited Fix Affected product E EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Published 08/10/2023 Severity Medium CVE-2023-3779Essential Addons For Elementor <=5.8.1 - Unauthenticated MailChimp API Key Disclosure Exploitation status Not known exploited Fix Affected product E Essential Addons for Elementor – Popular Elementor Templates & Widgets Published 07/20/2023 Severity Medium CVE-2020-36744NotificationX <= 1.8.2 - Cross-Site Request Forgery Bypass Exploitation status Not known exploited Fix Affected product N NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar Published 07/01/2023 Severity Medium 
