Wordpress Sikkerhed & Opdateringer

Missing Authorization to Authenticated (Contributor+) AI Access Token and Credit Disclosure

Skrevet den 4. september 2026 af i All in One SEO Pack

Plugin is vulnerable to unauthorized access of data due to a missing capability check on the `/aioseo/v1/ai/credits` REST route. This makes it possible for authenticated attackers, with Contributor-level access and above, to disclose the global AI access token.

This vulnerability affects the following application versions:

All in One SEO Pack 4.2.5.1
All in One SEO Pack 4.2.6
All in One SEO Pack 4.2.6.1
All in One SEO Pack 4.2.7.1
All in One SEO Pack 4.2.8
All in One SEO Pack 4.2.9
All in One SEO Pack 4.3.0
All in One SEO Pack 4.3.1
All in One SEO Pack 4.3.1.1
All in One SEO Pack 4.3.2
All in One SEO Pack 4.3.3
All in One SEO Pack 4.3.4.1
All in One SEO Pack 4.3.5
All in One SEO Pack 4.3.6.1
All in One SEO Pack 4.3.7
All in One SEO Pack 4.3.7.1
All in One SEO Pack 4.3.8
All in One SEO Pack 4.3.9
All in One SEO Pack 4.4.0.1
All in One SEO Pack 4.4.1
All in One SEO Pack 4.4.2
All in One SEO Pack 4.4.3
All in One SEO Pack 4.4.4
All in One SEO Pack 4.4.5.1
All in One SEO Pack 4.4.6
All in One SEO Pack 4.4.7
All in One SEO Pack 4.4.7.1
All in One SEO Pack 4.4.8
All in One SEO Pack 4.4.9.1
All in One SEO Pack 4.4.9.2
All in One SEO Pack 4.5.0
All in One SEO Pack 4.5.1.1
All in One SEO Pack 4.5.2.1
All in One SEO Pack 4.5.3.1
All in One SEO Pack 4.5.4
All in One SEO Pack 4.5.5
All in One SEO Pack 4.5.6
All in One SEO Pack 4.5.7.1
All in One SEO Pack 4.5.7.2
All in One SEO Pack 4.5.7.3
All in One SEO Pack 4.5.8
All in One SEO Pack 4.5.9.1
All in One SEO Pack 4.5.9.2
All in One SEO Pack 4.6.0
All in One SEO Pack 4.6.1.1
All in One SEO Pack 4.6.2
All in One SEO Pack 4.6.3
All in One SEO Pack 4.6.4
All in One SEO Pack 4.6.5
All in One SEO Pack 4.6.6
All in One SEO Pack 4.6.7.1
All in One SEO Pack 4.6.8.1
All in One SEO Pack 4.6.9
All in One SEO Pack 4.6.9.1
All in One SEO Pack 4.7.0
All in One SEO Pack 4.7.1.1
All in One SEO Pack 4.7.2
All in One SEO Pack 4.7.3
All in One SEO Pack 4.7.4.1
All in One SEO Pack 4.7.4.2
All in One SEO Pack 4.7.5
All in One SEO Pack 4.7.5.1
All in One SEO Pack 4.7.6
All in One SEO Pack 4.7.7
All in One SEO Pack 4.7.7.1
All in One SEO Pack 4.7.7.2
All in One SEO Pack 4.7.8
All in One SEO Pack 4.7.9
All in One SEO Pack 4.7.9.1
All in One SEO Pack 4.8.0
All in One SEO Pack 4.8.1
All in One SEO Pack 4.8.1.1
All in One SEO Pack 4.8.2
All in One SEO Pack 4.8.3.1
All in One SEO Pack 4.8.3.2
All in One SEO Pack 4.8.4.1
All in One SEO Pack 4.8.5
All in One SEO Pack 4.8.6
All in One SEO Pack 4.8.6.1
All in One SEO Pack 4.8.7.2
All in One SEO Pack 4.8.8
All in One SEO Pack 4.8.9
All in One SEO Pack 4.9.0
All in One SEO Pack 4.9.1
All in One SEO Pack 4.9.1.1
All in One SEO Pack 4.9.2

Improper Access Control Vulnerability — Admin Panel Bypass

Skrevet den 4. september 2026 af i Magento

A vulnerability in the access control logic allows a low-privileged attacker to bypass admin authorization checks and gain unauthorized access to restricted administrative functionality. Exploitation requires no user interaction and can lead to a security-feature bypass with potential (though limited) impact on confidentiality.

This vulnerability affects the following application versions:

Magento 1.0.0-beta
Magento 1.0.0-beta2
Magento 1.0.0-beta3
Magento 1.0.0-beta4
Magento 1.0.0-beta5
Magento 1.0.0-beta6
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.0.17
Magento 2.0.18
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11
Magento 2.1.12
Magento 2.1.13
Magento 2.1.14
Magento 2.1.15
Magento 2.1.16
Magento 2.1.17
Magento 2.1.18
Magento 2.2.0
Magento 2.2.0-rc2.0
Magento 2.2.0-rc2.1
Magento 2.2.0-rc2.2
Magento 2.2.0-rc2.3
Magento 2.2.0-rc3.0
Magento 2.2.0-RC1.1
Magento 2.2.0-RC1.2
Magento 2.2.0-RC1.3
Magento 2.2.0-RC1.4
Magento 2.2.0-RC1.5
Magento 2.2.0-RC1.6
Magento 2.2.0-RC1.8
Magento 2.2.1
Magento 2.2.2
Magento 2.2.3
Magento 2.2.4
Magento 2.2.5
Magento 2.2.6
Magento 2.2.7
Magento 2.2.8
Magento 2.2.9
Magento 2.2.10
Magento 2.2.11
Magento 2.3.0
Magento 2.3.1
Magento 2.3.2
Magento 2.3.2-p1
Magento 2.3.2-p2
Magento 2.3.3
Magento 2.3.3-p1
Magento 2.3.4
Magento 2.3.4-p2
Magento 2.3.5
Magento 2.3.5-p1
Magento 2.3.5-p2
Magento 2.3.6
Magento 2.3.6-p1
Magento 2.3.7
Magento 2.3.7-p1
Magento 2.3.7-p2
Magento 2.3.7-p3
Magento 2.3.7-p4
Magento 2.4.0
Magento 2.4.0-p1
Magento 2.4.1
Magento 2.4.1-p1
Magento 2.4.2
Magento 2.4.2-p1
Magento 2.4.2-p2
Magento 2.4.3
Magento 2.4.3-p1
Magento 2.4.3-p2
Magento 2.4.3-p3
Magento 2.4.4
Magento 2.4.4-p1
Magento 2.4.4-p2
Magento 2.4.4-p3
Magento 2.4.4-p4
Magento 2.4.4-p5
Magento 2.4.4-p6
Magento 2.4.4-p7
Magento 2.4.4-p8
Magento 2.4.4-p9
Magento 2.4.4-p10
Magento 2.4.5
Magento 2.4.5-p1
Magento 2.4.5-p2
Magento 2.4.5-p3
Magento 2.4.5-p4
Magento 2.4.5-p5
Magento 2.4.5-p6
Magento 2.4.5-p7
Magento 2.4.5-p8
Magento 2.4.5-p9
Magento 2.4.6
Magento 2.4.6-p1
Magento 2.4.6-p2
Magento 2.4.6-p3
Magento 2.4.6-p4
Magento 2.4.6-p5
Magento 2.4.6-p6
Magento 2.4.6-p7
Magento 2.4.7
Magento 2.4.7-beta1
Magento 2.4.7-beta2
Magento 2.4.7-beta3
Magento 2.4.7-p1
Magento 2.4.7-p2

Shortcode Injection via Merge Tag Values in Ninja Forms

Skrevet den 3. september 2026 af i Ninja Forms – The Contact Form Builder

Ninja Forms does not neutralize WordPress shortcode syntax in merge tag values, which can be populated from request-supplied form field defaults without authentication. Where merge tag output is later processed by do_shortcode(), an attacker-supplied [shortcode] is executed instead of displayed, allowing execution of any shortcode registered on the site.

This vulnerability affects the following application versions:

Ninja Forms – The Contact Form Builder 3.1.10
Ninja Forms – The Contact Form Builder 3.2.28
Ninja Forms – The Contact Form Builder 3.3.21.4
Ninja Forms – The Contact Form Builder 3.4.34.2
Ninja Forms – The Contact Form Builder 3.4.34.3
Ninja Forms – The Contact Form Builder 3.5.8.4
Ninja Forms – The Contact Form Builder 3.5.8.5
Ninja Forms – The Contact Form Builder 3.6.34
Ninja Forms – The Contact Form Builder 3.6.34.1
Ninja Forms – The Contact Form Builder 3.7.3
Ninja Forms – The Contact Form Builder 3.7.3.1
Ninja Forms – The Contact Form Builder 3.8.0
Ninja Forms – The Contact Form Builder 3.8.1
Ninja Forms – The Contact Form Builder 3.8.2
Ninja Forms – The Contact Form Builder 3.8.3
Ninja Forms – The Contact Form Builder 3.8.4
Ninja Forms – The Contact Form Builder 3.8.5
Ninja Forms – The Contact Form Builder 3.8.6
Ninja Forms – The Contact Form Builder 3.8.7
Ninja Forms – The Contact Form Builder 3.8.8
Ninja Forms – The Contact Form Builder 3.8.9
Ninja Forms – The Contact Form Builder 3.8.10
Ninja Forms – The Contact Form Builder 3.8.11
Ninja Forms – The Contact Form Builder 3.8.12
Ninja Forms – The Contact Form Builder 3.8.13
Ninja Forms – The Contact Form Builder 3.8.14
Ninja Forms – The Contact Form Builder 3.8.15
Ninja Forms – The Contact Form Builder 3.8.16
Ninja Forms – The Contact Form Builder 3.8.17
Ninja Forms – The Contact Form Builder 3.8.18
Ninja Forms – The Contact Form Builder 3.8.19
Ninja Forms – The Contact Form Builder 3.8.20
Ninja Forms – The Contact Form Builder 3.8.21
Ninja Forms – The Contact Form Builder 3.8.22
Ninja Forms – The Contact Form Builder 3.8.23
Ninja Forms – The Contact Form Builder 3.8.24
Ninja Forms – The Contact Form Builder 3.8.25
Ninja Forms – The Contact Form Builder 3.8.25.1
Ninja Forms – The Contact Form Builder 3.9.0
Ninja Forms – The Contact Form Builder 3.9.1
Ninja Forms – The Contact Form Builder 3.9.2
Ninja Forms – The Contact Form Builder 3.9.2.1
Ninja Forms – The Contact Form Builder 3.10.0
Ninja Forms – The Contact Form Builder 3.10.1
Ninja Forms – The Contact Form Builder 3.10.2
Ninja Forms – The Contact Form Builder 3.10.2.1
Ninja Forms – The Contact Form Builder 3.10.2.2
Ninja Forms – The Contact Form Builder 3.10.3
Ninja Forms – The Contact Form Builder 3.10.4
Ninja Forms – The Contact Form Builder 3.10.4.1
Ninja Forms – The Contact Form Builder 3.11.0
Ninja Forms – The Contact Form Builder 3.11.1
Ninja Forms – The Contact Form Builder 3.11.1.1
Ninja Forms – The Contact Form Builder 3.12.0
Ninja Forms – The Contact Form Builder 3.12.1
Ninja Forms – The Contact Form Builder 3.12.2
Ninja Forms – The Contact Form Builder 3.12.2.1
Ninja Forms – The Contact Form Builder 3.13.0
Ninja Forms – The Contact Form Builder 3.13.1
Ninja Forms – The Contact Form Builder 3.13.2
Ninja Forms – The Contact Form Builder 3.13.3
Ninja Forms – The Contact Form Builder 3.13.4
Ninja Forms – The Contact Form Builder 3.14.0
Ninja Forms – The Contact Form Builder 3.14.1
Ninja Forms – The Contact Form Builder 3.14.2
Ninja Forms – The Contact Form Builder 3.14.3
Ninja Forms – The Contact Form Builder 3.14.4
Ninja Forms – The Contact Form Builder 3.14.5
Ninja Forms – The Contact Form Builder 3.14.6
Ninja Forms – The Contact Form Builder 3.14.7
Ninja Forms – The Contact Form Builder 3.14.8
Ninja Forms – The Contact Form Builder 3.14.9

Improved code security enforcement

Skrevet den 3. september 20263. september 2026 af i Elementor Website Builder

Patched stored XSS vulnerabilities in the REST API request handling and Lightbox component, and fixed a missing authorization check in AI image uploads. Users without the unfiltered_html capability could previously inject malicious scripts via Elementor post data or crafted lightbox content. All three issues are resolved by enforcing proper input sanitization and permission verification.

This vulnerability affects the following application versions:

Elementor Website Builder 3.17.0
Elementor Website Builder 3.17.0-beta1
Elementor Website Builder 3.17.0-beta2
Elementor Website Builder 3.17.0-beta3
Elementor Website Builder 3.17.0-beta4
Elementor Website Builder 3.17.0-dev1
Elementor Website Builder 3.17.0-dev2
Elementor Website Builder 3.17.0-dev3
Elementor Website Builder 3.17.0-dev4
Elementor Website Builder 3.17.1
Elementor Website Builder 3.17.2
Elementor Website Builder 3.17.3
Elementor Website Builder 3.18.0
Elementor Website Builder 3.18.0-beta1
Elementor Website Builder 3.18.0-beta2
Elementor Website Builder 3.18.0-beta3
Elementor Website Builder 3.18.0-beta4
Elementor Website Builder 3.18.0-dev1
Elementor Website Builder 3.18.0-dev2
Elementor Website Builder 3.18.0-dev3
Elementor Website Builder 3.18.0-dev4
Elementor Website Builder 3.18.1
Elementor Website Builder 3.18.2
Elementor Website Builder 3.18.3
Elementor Website Builder 3.19.0
Elementor Website Builder 3.19.0-beta1
Elementor Website Builder 3.19.0-beta2
Elementor Website Builder 3.19.0-beta3
Elementor Website Builder 3.19.0-beta4
Elementor Website Builder 3.19.0-beta5
Elementor Website Builder 3.19.0-beta6
Elementor Website Builder 3.19.0-dev1
Elementor Website Builder 3.19.0-dev2
Elementor Website Builder 3.19.0-dev3
Elementor Website Builder 3.19.0-dev4
Elementor Website Builder 3.19.0-dev5
Elementor Website Builder 3.19.0-dev6
Elementor Website Builder 3.19.1
Elementor Website Builder 3.19.2
Elementor Website Builder 3.19.3
Elementor Website Builder 3.19.4
Elementor Website Builder 3.20.0
Elementor Website Builder 3.20.0-beta1
Elementor Website Builder 3.20.0-beta2
Elementor Website Builder 3.20.0-beta3
Elementor Website Builder 3.20.0-beta4
Elementor Website Builder 3.20.0-dev1
Elementor Website Builder 3.20.0-dev2
Elementor Website Builder 3.20.0-dev3
Elementor Website Builder 3.20.0-dev4
Elementor Website Builder 3.20.1
Elementor Website Builder 3.20.2
Elementor Website Builder 3.20.3
Elementor Website Builder 3.20.4
Elementor Website Builder 3.21.0
Elementor Website Builder 3.21.0-beta1
Elementor Website Builder 3.21.0-beta2
Elementor Website Builder 3.21.0-beta3
Elementor Website Builder 3.21.0-dev1
Elementor Website Builder 3.21.0-dev2
Elementor Website Builder 3.21.0-dev3
Elementor Website Builder 3.21.1
Elementor Website Builder 3.21.2
Elementor Website Builder 3.21.3
Elementor Website Builder 3.21.4
Elementor Website Builder 3.21.5
Elementor Website Builder 3.21.6
Elementor Website Builder 3.21.7
Elementor Website Builder 3.21.8
Elementor Website Builder 3.22.0
Elementor Website Builder 3.22.0-beta1
Elementor Website Builder 3.22.0-beta2
Elementor Website Builder 3.22.0-beta3
Elementor Website Builder 3.22.0-beta4
Elementor Website Builder 3.22.0-beta5
Elementor Website Builder 3.22.0-beta6
Elementor Website Builder 3.22.0-dev1
Elementor Website Builder 3.22.0-dev2
Elementor Website Builder 3.22.0-dev3
Elementor Website Builder 3.22.0-dev4
Elementor Website Builder 3.22.0-dev5
Elementor Website Builder 3.22.0-dev6
Elementor Website Builder 3.22.1
Elementor Website Builder 3.22.2
Elementor Website Builder 3.22.3
Elementor Website Builder 3.23.0
Elementor Website Builder 3.23.0-beta1
Elementor Website Builder 3.23.0-beta2
Elementor Website Builder 3.23.0-beta3
Elementor Website Builder 3.23.0-beta4
Elementor Website Builder 3.23.0-beta5
Elementor Website Builder 3.23.0-beta6
Elementor Website Builder 3.23.0-dev1
Elementor Website Builder 3.23.0-dev2
Elementor Website Builder 3.23.0-dev3
Elementor Website Builder 3.23.0-dev4
Elementor Website Builder 3.23.0-dev5
Elementor Website Builder 3.23.0-dev6
Elementor Website Builder 3.23.1
Elementor Website Builder 3.23.2
Elementor Website Builder 3.23.3
Elementor Website Builder 3.23.4
Elementor Website Builder 3.24.0
Elementor Website Builder 3.24.0-beta1
Elementor Website Builder 3.24.0-beta2
Elementor Website Builder 3.24.0-beta3
Elementor Website Builder 3.24.0-dev1
Elementor Website Builder 3.24.0-dev2
Elementor Website Builder 3.24.0-dev3
Elementor Website Builder 3.24.1
Elementor Website Builder 3.24.2
Elementor Website Builder 3.24.3
Elementor Website Builder 3.24.4
Elementor Website Builder 3.24.5
Elementor Website Builder 3.24.6
Elementor Website Builder 3.24.7
Elementor Website Builder 3.24.8
Elementor Website Builder 3.25.0
Elementor Website Builder 3.25.0-beta1
Elementor Website Builder 3.25.0-beta2
Elementor Website Builder 3.25.0-beta3
Elementor Website Builder 3.25.0-dev1
Elementor Website Builder 3.25.0-dev2
Elementor Website Builder 3.25.0-dev3
Elementor Website Builder 3.25.1
Elementor Website Builder 3.25.2
Elementor Website Builder 3.25.3
Elementor Website Builder 3.25.4
Elementor Website Builder 3.25.5
Elementor Website Builder 3.25.6
Elementor Website Builder 3.25.7
Elementor Website Builder 3.25.8
Elementor Website Builder 3.25.9
Elementor Website Builder 3.25.10
Elementor Website Builder 3.25.11
Elementor Website Builder 3.26.0
Elementor Website Builder 3.26.0-beta1
Elementor Website Builder 3.26.0-beta2
Elementor Website Builder 3.26.0-beta3
Elementor Website Builder 3.26.0-beta4
Elementor Website Builder 3.26.0-beta5
Elementor Website Builder 3.26.0-dev1
Elementor Website Builder 3.26.0-dev2
Elementor Website Builder 3.26.0-dev3
Elementor Website Builder 3.26.0-dev4
Elementor Website Builder 3.26.0-dev5
Elementor Website Builder 3.26.1
Elementor Website Builder 3.26.2
Elementor Website Builder 3.26.3
Elementor Website Builder 3.26.4
Elementor Website Builder 3.26.5
Elementor Website Builder 3.27.0
Elementor Website Builder 3.27.0-beta1
Elementor Website Builder 3.27.0-beta2
Elementor Website Builder 3.27.0-dev1
Elementor Website Builder 3.27.0-dev2
Elementor Website Builder 3.27.1
Elementor Website Builder 3.27.2
Elementor Website Builder 3.27.3
Elementor Website Builder 3.27.4
Elementor Website Builder 3.27.5
Elementor Website Builder 3.27.6
Elementor Website Builder 3.27.7
Elementor Website Builder 3.28.0
Elementor Website Builder 3.28.0-beta1
Elementor Website Builder 3.28.0-beta2
Elementor Website Builder 3.28.0-beta3
Elementor Website Builder 3.28.0-dev1
Elementor Website Builder 3.28.0-dev2
Elementor Website Builder 3.28.0-dev3
Elementor Website Builder 3.28.1
Elementor Website Builder 3.28.2
Elementor Website Builder 3.28.3
Elementor Website Builder 3.28.4
Elementor Website Builder 3.29.0
Elementor Website Builder 3.29.0-beta1
Elementor Website Builder 3.29.0-beta2
Elementor Website Builder 3.29.0-beta3
Elementor Website Builder 3.29.0-beta4
Elementor Website Builder 3.29.0-dev1
Elementor Website Builder 3.29.0-dev2
Elementor Website Builder 3.29.0-dev3
Elementor Website Builder 3.29.0-dev4
Elementor Website Builder 3.29.1
Elementor Website Builder 3.29.2
Elementor Website Builder 3.30.0
Elementor Website Builder 3.30.0-beta1
Elementor Website Builder 3.30.0-beta2
Elementor Website Builder 3.30.0-beta3
Elementor Website Builder 3.30.0-dev1
Elementor Website Builder 3.30.0-dev2
Elementor Website Builder 3.30.0-dev3
Elementor Website Builder 3.30.1
Elementor Website Builder 3.30.2
Elementor Website Builder 3.30.3
Elementor Website Builder 3.30.4
Elementor Website Builder 3.31.0
Elementor Website Builder 3.31.0-beta1
Elementor Website Builder 3.31.0-beta2
Elementor Website Builder 3.31.0-dev1
Elementor Website Builder 3.31.0-dev2
Elementor Website Builder 3.31.1
Elementor Website Builder 3.31.2
Elementor Website Builder 3.31.3
Elementor Website Builder 3.31.4
Elementor Website Builder 3.31.5
Elementor Website Builder 3.32.0
Elementor Website Builder 3.32.0-beta1
Elementor Website Builder 3.32.0-beta2
Elementor Website Builder 3.32.0-beta3
Elementor Website Builder 3.32.0-dev1
Elementor Website Builder 3.32.0-dev2
Elementor Website Builder 3.32.0-dev3
Elementor Website Builder 3.32.1
Elementor Website Builder 3.32.2
Elementor Website Builder 3.32.3
Elementor Website Builder 3.32.4
Elementor Website Builder 3.32.5
Elementor Website Builder 3.33.0
Elementor Website Builder 3.33.0-beta1
Elementor Website Builder 3.33.0-beta2
Elementor Website Builder 3.33.0-beta3
Elementor Website Builder 3.33.0-beta4
Elementor Website Builder 3.33.0-dev1
Elementor Website Builder 3.33.0-dev2
Elementor Website Builder 3.33.0-dev3
Elementor Website Builder 3.33.0-dev4
Elementor Website Builder 3.33.1
Elementor Website Builder 3.33.2
Elementor Website Builder 3.33.3
Elementor Website Builder 3.33.4
Elementor Website Builder 3.33.5
Elementor Website Builder 3.33.6
Elementor Website Builder 3.34.0
Elementor Website Builder 3.34.0-beta1
Elementor Website Builder 3.34.0-beta2
Elementor Website Builder 3.34.0-beta3
Elementor Website Builder 3.34.0-dev1
Elementor Website Builder 3.34.0-dev2
Elementor Website Builder 3.34.1
Elementor Website Builder 3.34.2
Elementor Website Builder 3.34.3
Elementor Website Builder 3.34.4
Elementor Website Builder 3.35.0
Elementor Website Builder 3.35.0-beta1
Elementor Website Builder 3.35.0-beta2
Elementor Website Builder 3.35.0-beta3
Elementor Website Builder 3.35.0-beta4
Elementor Website Builder 3.35.0-dev1
Elementor Website Builder 3.35.0-dev2
Elementor Website Builder 3.35.0-dev3
Elementor Website Builder 3.35.0-dev4
Elementor Website Builder 3.35.1
Elementor Website Builder 3.35.2
Elementor Website Builder 3.35.3
Elementor Website Builder 3.35.4
Elementor Website Builder 3.35.5

Missing Authorization in template JSON import

Skrevet den 1. september 2026 af i Elementor Website Builder

In versions lower than4.2.1, Template_LibraryManager::import_template() unconditionally enabled unfiltered JSON upload for any caller that reached it, by adding the elementor/files/allow-file-type/json and elementor/files/allow_unfiltered_upload filters. The capability helper User::is_current_user_can_upload_json() existed but was only consulted by the editor UI to decide whether to show the “Import Templates” control — it did not guard the endpoint. The AJAX dispatcher ajax_before_action_response() likewise had no per-action check for import_template. A user without JSON-upload rights could call the import action directly and upload a crafted JSON template, defeating the intended file-type restriction.

This vulnerability affects the following application versions:

Elementor Website Builder 3.13.2
Elementor Website Builder 3.13.3
Elementor Website Builder 3.13.4
Elementor Website Builder 3.14.0
Elementor Website Builder 3.14.0-beta1
Elementor Website Builder 3.14.0-beta2
Elementor Website Builder 3.14.0-beta3
Elementor Website Builder 3.14.0-beta4
Elementor Website Builder 3.14.0-beta5
Elementor Website Builder 3.14.0-dev1
Elementor Website Builder 3.14.0-dev2
Elementor Website Builder 3.14.0-dev3
Elementor Website Builder 3.14.0-dev4
Elementor Website Builder 3.14.0-dev5
Elementor Website Builder 3.14.1
Elementor Website Builder 3.15.0
Elementor Website Builder 3.15.0-beta1
Elementor Website Builder 3.15.0-beta2
Elementor Website Builder 3.15.0-beta3
Elementor Website Builder 3.15.0-beta4
Elementor Website Builder 3.15.0-beta5
Elementor Website Builder 3.15.0-beta6
Elementor Website Builder 3.15.0-dev1
Elementor Website Builder 3.15.0-dev2
Elementor Website Builder 3.15.0-dev3
Elementor Website Builder 3.15.0-dev4
Elementor Website Builder 3.15.0-dev5
Elementor Website Builder 3.15.0-dev6
Elementor Website Builder 3.15.1
Elementor Website Builder 3.15.2
Elementor Website Builder 3.15.3
Elementor Website Builder 3.16.0
Elementor Website Builder 3.16.0-beta1
Elementor Website Builder 3.16.0-beta2
Elementor Website Builder 3.16.0-beta3
Elementor Website Builder 3.16.0-beta4
Elementor Website Builder 3.16.0-dev1
Elementor Website Builder 3.16.0-dev2
Elementor Website Builder 3.16.0-dev3
Elementor Website Builder 3.16.0-dev4
Elementor Website Builder 3.16.1
Elementor Website Builder 3.16.2
Elementor Website Builder 3.16.3
Elementor Website Builder 3.16.4
Elementor Website Builder 3.16.5
Elementor Website Builder 3.16.6
Elementor Website Builder 3.17.0
Elementor Website Builder 3.17.0-beta1
Elementor Website Builder 3.17.0-beta2
Elementor Website Builder 3.17.0-beta3
Elementor Website Builder 3.17.0-beta4
Elementor Website Builder 3.17.0-dev1
Elementor Website Builder 3.17.0-dev2
Elementor Website Builder 3.17.0-dev3
Elementor Website Builder 3.17.0-dev4
Elementor Website Builder 3.17.1
Elementor Website Builder 3.17.2
Elementor Website Builder 3.17.3
Elementor Website Builder 3.18.0
Elementor Website Builder 3.18.0-beta1
Elementor Website Builder 3.18.0-beta2
Elementor Website Builder 3.18.0-beta3
Elementor Website Builder 3.18.0-beta4
Elementor Website Builder 3.18.0-dev1
Elementor Website Builder 3.18.0-dev2
Elementor Website Builder 3.18.0-dev3
Elementor Website Builder 3.18.0-dev4
Elementor Website Builder 3.18.1
Elementor Website Builder 3.18.2
Elementor Website Builder 3.18.3
Elementor Website Builder 3.19.0
Elementor Website Builder 3.19.0-beta1
Elementor Website Builder 3.19.0-beta2
Elementor Website Builder 3.19.0-beta3
Elementor Website Builder 3.19.0-beta4
Elementor Website Builder 3.19.0-beta5
Elementor Website Builder 3.19.0-beta6
Elementor Website Builder 3.19.0-dev1
Elementor Website Builder 3.19.0-dev2
Elementor Website Builder 3.19.0-dev3
Elementor Website Builder 3.19.0-dev4
Elementor Website Builder 3.19.0-dev5
Elementor Website Builder 3.19.0-dev6
Elementor Website Builder 3.19.1
Elementor Website Builder 3.19.2
Elementor Website Builder 3.19.3
Elementor Website Builder 3.19.4
Elementor Website Builder 3.20.0
Elementor Website Builder 3.20.0-beta1
Elementor Website Builder 3.20.0-beta2
Elementor Website Builder 3.20.0-beta3
Elementor Website Builder 3.20.0-beta4
Elementor Website Builder 3.20.0-dev1
Elementor Website Builder 3.20.0-dev2
Elementor Website Builder 3.20.0-dev3
Elementor Website Builder 3.20.0-dev4
Elementor Website Builder 3.20.1
Elementor Website Builder 3.20.2
Elementor Website Builder 3.20.3
Elementor Website Builder 3.20.4
Elementor Website Builder 3.21.0
Elementor Website Builder 3.21.0-beta1
Elementor Website Builder 3.21.0-beta2
Elementor Website Builder 3.21.0-beta3
Elementor Website Builder 3.21.0-dev1
Elementor Website Builder 3.21.0-dev2
Elementor Website Builder 3.21.0-dev3
Elementor Website Builder 3.21.1
Elementor Website Builder 3.21.2
Elementor Website Builder 3.21.3
Elementor Website Builder 3.21.4
Elementor Website Builder 3.21.5
Elementor Website Builder 3.21.6
Elementor Website Builder 3.21.7
Elementor Website Builder 3.21.8
Elementor Website Builder 3.22.0
Elementor Website Builder 3.22.0-beta1
Elementor Website Builder 3.22.0-beta2
Elementor Website Builder 3.22.0-beta3
Elementor Website Builder 3.22.0-beta4
Elementor Website Builder 3.22.0-beta5
Elementor Website Builder 3.22.0-beta6
Elementor Website Builder 3.22.0-dev1
Elementor Website Builder 3.22.0-dev2
Elementor Website Builder 3.22.0-dev3
Elementor Website Builder 3.22.0-dev4
Elementor Website Builder 3.22.0-dev5
Elementor Website Builder 3.22.0-dev6
Elementor Website Builder 3.22.1
Elementor Website Builder 3.22.2
Elementor Website Builder 3.22.3
Elementor Website Builder 3.23.0
Elementor Website Builder 3.23.0-beta1
Elementor Website Builder 3.23.0-beta2
Elementor Website Builder 3.23.0-beta3
Elementor Website Builder 3.23.0-beta4
Elementor Website Builder 3.23.0-beta5
Elementor Website Builder 3.23.0-beta6
Elementor Website Builder 3.23.0-dev1
Elementor Website Builder 3.23.0-dev2
Elementor Website Builder 3.23.0-dev3
Elementor Website Builder 3.23.0-dev4
Elementor Website Builder 3.23.0-dev5
Elementor Website Builder 3.23.0-dev6
Elementor Website Builder 3.23.1
Elementor Website Builder 3.23.2
Elementor Website Builder 3.23.3
Elementor Website Builder 3.23.4
Elementor Website Builder 3.24.0
Elementor Website Builder 3.24.0-beta1
Elementor Website Builder 3.24.0-beta2
Elementor Website Builder 3.24.0-beta3
Elementor Website Builder 3.24.0-dev1
Elementor Website Builder 3.24.0-dev2
Elementor Website Builder 3.24.0-dev3
Elementor Website Builder 3.24.1
Elementor Website Builder 3.24.2
Elementor Website Builder 3.24.3
Elementor Website Builder 3.24.4
Elementor Website Builder 3.24.5
Elementor Website Builder 3.24.6
Elementor Website Builder 3.24.7
Elementor Website Builder 3.24.8
Elementor Website Builder 3.25.0
Elementor Website Builder 3.25.0-beta1
Elementor Website Builder 3.25.0-beta2
Elementor Website Builder 3.25.0-beta3
Elementor Website Builder 3.25.0-dev1
Elementor Website Builder 3.25.0-dev2
Elementor Website Builder 3.25.0-dev3
Elementor Website Builder 3.25.1
Elementor Website Builder 3.25.2
Elementor Website Builder 3.25.3
Elementor Website Builder 3.25.4
Elementor Website Builder 3.25.5
Elementor Website Builder 3.25.6
Elementor Website Builder 3.25.7
Elementor Website Builder 3.25.8
Elementor Website Builder 3.25.9
Elementor Website Builder 3.25.10
Elementor Website Builder 3.25.11
Elementor Website Builder 3.26.0
Elementor Website Builder 3.26.0-beta1
Elementor Website Builder 3.26.0-beta2
Elementor Website Builder 3.26.0-beta3
Elementor Website Builder 3.26.0-beta4
Elementor Website Builder 3.26.0-beta5
Elementor Website Builder 3.26.0-dev1
Elementor Website Builder 3.26.0-dev2
Elementor Website Builder 3.26.0-dev3
Elementor Website Builder 3.26.0-dev4
Elementor Website Builder 3.26.0-dev5
Elementor Website Builder 3.26.1
Elementor Website Builder 3.26.2
Elementor Website Builder 3.26.3
Elementor Website Builder 3.26.4
Elementor Website Builder 3.26.5
Elementor Website Builder 3.27.0
Elementor Website Builder 3.27.0-beta1
Elementor Website Builder 3.27.0-beta2
Elementor Website Builder 3.27.0-dev1
Elementor Website Builder 3.27.0-dev2
Elementor Website Builder 3.27.1
Elementor Website Builder 3.27.2
Elementor Website Builder 3.27.3
Elementor Website Builder 3.27.4
Elementor Website Builder 3.27.5
Elementor Website Builder 3.27.6
Elementor Website Builder 3.27.7
Elementor Website Builder 3.28.0
Elementor Website Builder 3.28.0-beta1
Elementor Website Builder 3.28.0-beta2
Elementor Website Builder 3.28.0-beta3
Elementor Website Builder 3.28.0-dev1
Elementor Website Builder 3.28.0-dev2
Elementor Website Builder 3.28.0-dev3
Elementor Website Builder 3.28.1
Elementor Website Builder 3.28.2
Elementor Website Builder 3.28.3
Elementor Website Builder 3.28.4
Elementor Website Builder 3.29.0
Elementor Website Builder 3.29.0-beta1
Elementor Website Builder 3.29.0-beta2
Elementor Website Builder 3.29.0-beta3
Elementor Website Builder 3.29.0-beta4
Elementor Website Builder 3.29.0-dev1
Elementor Website Builder 3.29.0-dev2
Elementor Website Builder 3.29.0-dev3
Elementor Website Builder 3.29.0-dev4
Elementor Website Builder 3.29.1
Elementor Website Builder 3.29.2
Elementor Website Builder 3.30.0
Elementor Website Builder 3.30.0-beta1
Elementor Website Builder 3.30.0-beta2
Elementor Website Builder 3.30.0-beta3
Elementor Website Builder 3.30.0-dev1
Elementor Website Builder 3.30.0-dev2
Elementor Website Builder 3.30.0-dev3
Elementor Website Builder 3.30.1
Elementor Website Builder 3.30.2
Elementor Website Builder 3.30.3
Elementor Website Builder 3.30.4
Elementor Website Builder 3.31.0
Elementor Website Builder 3.31.0-beta1
Elementor Website Builder 3.31.0-beta2
Elementor Website Builder 3.31.0-dev1
Elementor Website Builder 3.31.0-dev2
Elementor Website Builder 3.31.1
Elementor Website Builder 3.31.2
Elementor Website Builder 3.31.3
Elementor Website Builder 3.31.4
Elementor Website Builder 3.31.5
Elementor Website Builder 3.32.0
Elementor Website Builder 3.32.0-beta1
Elementor Website Builder 3.32.0-beta2
Elementor Website Builder 3.32.0-beta3
Elementor Website Builder 3.32.0-dev1
Elementor Website Builder 3.32.0-dev2
Elementor Website Builder 3.32.0-dev3
Elementor Website Builder 3.32.1
Elementor Website Builder 3.32.2
Elementor Website Builder 3.32.3
Elementor Website Builder 3.32.4
Elementor Website Builder 3.32.5
Elementor Website Builder 3.33.0
Elementor Website Builder 3.33.0-beta1
Elementor Website Builder 3.33.0-beta2
Elementor Website Builder 3.33.0-beta3
Elementor Website Builder 3.33.0-beta4
Elementor Website Builder 3.33.0-dev1
Elementor Website Builder 3.33.0-dev2
Elementor Website Builder 3.33.0-dev3
Elementor Website Builder 3.33.0-dev4
Elementor Website Builder 3.33.1
Elementor Website Builder 3.33.2
Elementor Website Builder 3.33.3
Elementor Website Builder 3.33.4
Elementor Website Builder 3.33.5
Elementor Website Builder 3.33.6
Elementor Website Builder 3.34.0
Elementor Website Builder 3.34.0-beta1
Elementor Website Builder 3.34.0-beta2
Elementor Website Builder 3.34.0-beta3
Elementor Website Builder 3.34.0-dev1
Elementor Website Builder 3.34.0-dev2
Elementor Website Builder 3.34.1
Elementor Website Builder 3.34.2
Elementor Website Builder 3.34.3
Elementor Website Builder 3.34.4
Elementor Website Builder 3.35.0
Elementor Website Builder 3.35.0-beta1
Elementor Website Builder 3.35.0-beta2
Elementor Website Builder 3.35.0-beta3
Elementor Website Builder 3.35.0-beta4
Elementor Website Builder 3.35.0-dev1
Elementor Website Builder 3.35.0-dev2
Elementor Website Builder 3.35.0-dev3
Elementor Website Builder 3.35.0-dev4
Elementor Website Builder 3.35.1
Elementor Website Builder 3.35.2
Elementor Website Builder 3.35.3
Elementor Website Builder 3.35.4
Elementor Website Builder 3.35.5
Elementor Website Builder 3.35.6
Elementor Website Builder 3.35.7
Elementor Website Builder 3.35.8
Elementor Website Builder 3.35.9
Elementor Website Builder 4.0.0
Elementor Website Builder 4.0.0-beta1
Elementor Website Builder 4.0.0-beta2
Elementor Website Builder 4.0.0-beta3
Elementor Website Builder 4.0.0-beta4
Elementor Website Builder 4.0.0-beta5
Elementor Website Builder 4.0.0-dev1
Elementor Website Builder 4.0.0-dev2
Elementor Website Builder 4.0.0-dev3
Elementor Website Builder 4.0.0-dev4
Elementor Website Builder 4.0.0-dev5
Elementor Website Builder 4.0.1
Elementor Website Builder 4.0.2
Elementor Website Builder 4.0.3
Elementor Website Builder 4.0.4
Elementor Website Builder 4.0.5
Elementor Website Builder 4.0.6
Elementor Website Builder 4.0.7
Elementor Website Builder 4.0.8
Elementor Website Builder 4.0.9
Elementor Website Builder 4.1.0
Elementor Website Builder 4.1.0-beta1
Elementor Website Builder 4.1.0-dev1
Elementor Website Builder 4.1.0-dev2
Elementor Website Builder 4.1.0-dev3
Elementor Website Builder 4.1.1
Elementor Website Builder 4.1.2
Elementor Website Builder 4.1.3
Elementor Website Builder 4.1.4
Elementor Website Builder 4.1.5
Elementor Website Builder 4.2.0
Elementor Website Builder 4.2.0-beta1
Elementor Website Builder 4.2.0-beta2
Elementor Website Builder 4.2.0-dev2

Two-factor authentication bypass in Defender 2FA login integration

Skrevet den 1. september 2026 af i Forminator Forms

Forminator’s front-end user-login form integrates with WP Defender’s two-factor authentication. In the 2FA verification branch, the provider is resolved from the attacker-controlled auth_method POST parameter via get_provider_by_slug(). In 1.55.1, when that lookup returned a WP_Error (unknown or disabled provider slug), the code fell through without setting $response[‘authentication’] and without returning — execution reached the final if ( empty( $sign_on ) || ! is_wp_error( $sign_on ) ) block and the user was signed on with wp_signon(), skipping the second factor entirely. An attacker who knows a valid username and password can therefore defeat the 2FA requirement by submitting an invalid auth_method value.

The fix adds the missing else branch that sets $response[‘authentication’] = ‘invalid’ and returns early, so a failed provider lookup can no longer fall through to sign-on. Exploitation requires WP Defender active with 2FA enabled for the target account.

This vulnerability affects the following application versions:

Forminator Forms 1.15.13
Forminator Forms 1.15.14
Forminator Forms 1.16.2
Forminator Forms 1.17.1
Forminator Forms 1.17.2
Forminator Forms 1.18.1
Forminator Forms 1.18.2
Forminator Forms 1.19.0
Forminator Forms 1.20.1
Forminator Forms 1.21.0
Forminator Forms 1.22.1
Forminator Forms 1.23.3
Forminator Forms 1.24.1
Forminator Forms 1.24.4
Forminator Forms 1.24.5
Forminator Forms 1.24.6
Forminator Forms 1.25.0
Forminator Forms 1.25.1
Forminator Forms 1.25.2
Forminator Forms 1.26.0
Forminator Forms 1.27.0
Forminator Forms 1.28.0
Forminator Forms 1.28.1
Forminator Forms 1.29.0
Forminator Forms 1.29.2
Forminator Forms 1.29.3
Forminator Forms 1.30.2
Forminator Forms 1.31.0
Forminator Forms 1.32.0
Forminator Forms 1.33.0
Forminator Forms 1.34.0
Forminator Forms 1.34.1
Forminator Forms 1.35.0
Forminator Forms 1.35.1
Forminator Forms 1.36.0
Forminator Forms 1.36.1
Forminator Forms 1.36.2
Forminator Forms 1.36.3
Forminator Forms 1.37.1
Forminator Forms 1.38.1
Forminator Forms 1.38.2
Forminator Forms 1.38.3
Forminator Forms 1.39.0
Forminator Forms 1.39.1
Forminator Forms 1.39.2
Forminator Forms 1.39.3
Forminator Forms 1.40.0
Forminator Forms 1.41.1
Forminator Forms 1.41.2
Forminator Forms 1.42.0
Forminator Forms 1.42.1
Forminator Forms 1.42.2
Forminator Forms 1.43.0
Forminator Forms 1.43.1
Forminator Forms 1.44
Forminator Forms 1.44.1
Forminator Forms 1.44.2
Forminator Forms 1.44.3
Forminator Forms 1.45
Forminator Forms 1.45.1
Forminator Forms 1.46.1
Forminator Forms 1.46.2
Forminator Forms 1.47
Forminator Forms 1.48.2
Forminator Forms 1.48.3
Forminator Forms 1.49.0
Forminator Forms 1.49.2
Forminator Forms 1.50.1
Forminator Forms 1.50.3
Forminator Forms 1.51
Forminator Forms 1.51.1
Forminator Forms 1.52
Forminator Forms 1.52.1
Forminator Forms 1.52.2
Forminator Forms 1.53.0
Forminator Forms 1.53.0.1
Forminator Forms 1.53.1
Forminator Forms 1.53.2
Forminator Forms 1.54
Forminator Forms 1.54.0
Forminator Forms 1.55.0
Forminator Forms 1.55.0.1
Forminator Forms 1.55.0.2
Forminator Forms 1.55.1

DOM-based XSS via OptinMonster reCAPTCHA Reset

Skrevet den 1. september 2026 af i WPForms

When an OptinMonster campaign popup containing a WPForms form is shown, WPForms’ `bindOptinMonster()` handler calls `optinMonsterRecaptchaReset()` to re-render the reCAPTCHA/hCaptcha/Turnstile widget inside the popup. The vulnerable code read the widget’s `data-sitekey` attribute value and built a new widget element via raw HTML string concatenation (`’

‘`) which was then inserted into the DOM with jQuery’s `.prepend(htmlString)` — a markup-parsing sink. A specially crafted OptinMonster campaign supplying a malicious `data-sitekey` value (e.g. containing `”>`) could break out of the attribute context and inject arbitrary script, since the concatenated string is parsed as HTML rather than treated as literal attribute text.

This vulnerability affects the following application versions:

WPForms 1.8.7.2
WPForms 1.8.8.2
WPForms 1.8.8.3
WPForms 1.8.9.1
WPForms 1.8.9.2
WPForms 1.8.9.4
WPForms 1.8.9.5
WPForms 1.8.9.6
WPForms 1.9.0.1
WPForms 1.9.0.2
WPForms 1.9.0.3
WPForms 1.9.0.4
WPForms 1.9.1.1
WPForms 1.9.1.2
WPForms 1.9.1.3
WPForms 1.9.1.4
WPForms 1.9.1.5
WPForms 1.9.1.6
WPForms 1.9.2.1
WPForms 1.9.2.2
WPForms 1.9.2.3
WPForms 1.9.3.1
WPForms 1.9.3.2
WPForms 1.9.4.1
WPForms 1.9.4.2
WPForms 1.9.5
WPForms 1.9.5.1
WPForms 1.9.5.2
WPForms 1.9.6
WPForms 1.9.6.1
WPForms 1.9.6.2
WPForms 1.9.7.1
WPForms 1.9.7.2
WPForms 1.9.7.3
WPForms 1.9.8.1
WPForms 1.9.8.2
WPForms 1.9.8.4
WPForms 1.9.8.7
WPForms 1.9.9.2
WPForms 1.9.9.3
WPForms 1.9.9.4
WPForms 1.10.0.1
WPForms 1.10.0.2
WPForms 1.10.0.3
WPForms 1.10.0.4
WPForms 1.10.0.5
WPForms 1.10.1
WPForms 1.10.1.1
WPForms 1.10.2
WPForms 1.10.2.1
WPForms 2.0.0.1

Stored XSS in Product Compare via unescaped product SKU / attribute term name

Skrevet den 18. august 2026 af i Essential Addons for Elementor

The Product Compare widget’s comparison table populated the SKU and taxonomy-term-name fields directly from WooCommerce product data (`$sku`, `$term->name`) without output escaping before rendering. Both values can originate from vendor/product-editor input (e.g. multi-vendor marketplaces) and are rendered on the public comparison table. Fixed by wrapping both with `esc_html()`.

This vulnerability affects the following application versions:

Essential Addons for Elementor 4.4.0
Essential Addons for Elementor 4.4.1
Essential Addons for Elementor 4.5.0
Essential Addons for Elementor 4.5.1
Essential Addons for Elementor 4.5.2
Essential Addons for Elementor 4.5.3
Essential Addons for Elementor 4.5.4
Essential Addons for Elementor 4.5.5
Essential Addons for Elementor 4.6.0
Essential Addons for Elementor 4.6.1
Essential Addons for Elementor 4.6.2
Essential Addons for Elementor 4.6.3
Essential Addons for Elementor 4.6.4
Essential Addons for Elementor 4.6.5
Essential Addons for Elementor 4.6.6
Essential Addons for Elementor 4.7.0
Essential Addons for Elementor 4.7.1
Essential Addons for Elementor 4.7.2
Essential Addons for Elementor 4.7.3
Essential Addons for Elementor 4.7.4
Essential Addons for Elementor 4.7.5
Essential Addons for Elementor 4.8.0
Essential Addons for Elementor 4.8.1
Essential Addons for Elementor 4.8.2
Essential Addons for Elementor 4.8.3
Essential Addons for Elementor 4.8.4
Essential Addons for Elementor 4.9.0
Essential Addons for Elementor 4.9.1
Essential Addons for Elementor 4.9.2
Essential Addons for Elementor 4.9.3
Essential Addons for Elementor 4.9.4
Essential Addons for Elementor 4.9.5
Essential Addons for Elementor 4.9.6
Essential Addons for Elementor 4.9.7
Essential Addons for Elementor 5.0.0
Essential Addons for Elementor 5.0.1
Essential Addons for Elementor 5.0.2
Essential Addons for Elementor 5.0.3
Essential Addons for Elementor 5.0.4
Essential Addons for Elementor 5.0.5
Essential Addons for Elementor 5.0.6
Essential Addons for Elementor 5.0.7
Essential Addons for Elementor 5.0.8
Essential Addons for Elementor 5.0.9
Essential Addons for Elementor 5.0.10
Essential Addons for Elementor 5.0.11
Essential Addons for Elementor 5.0.12
Essential Addons for Elementor 5.0.13
Essential Addons for Elementor 5.1.0
Essential Addons for Elementor 5.1.1
Essential Addons for Elementor 5.1.2
Essential Addons for Elementor 5.1.3
Essential Addons for Elementor 5.1.4
Essential Addons for Elementor 5.1.5
Essential Addons for Elementor 5.1.6
Essential Addons for Elementor 5.1.7
Essential Addons for Elementor 5.1.8
Essential Addons for Elementor 5.1.9
Essential Addons for Elementor 5.2.0
Essential Addons for Elementor 5.2.1
Essential Addons for Elementor 5.2.2
Essential Addons for Elementor 5.2.3
Essential Addons for Elementor 5.2.4
Essential Addons for Elementor 5.3.0
Essential Addons for Elementor 5.3.1
Essential Addons for Elementor 5.3.2
Essential Addons for Elementor 5.4.6
Essential Addons for Elementor 5.5.5
Essential Addons for Elementor 5.6.5
Essential Addons for Elementor 5.7.2
Essential Addons for Elementor 5.7.3
Essential Addons for Elementor 5.7.4
Essential Addons for Elementor 5.8.0
Essential Addons for Elementor 5.8.1
Essential Addons for Elementor 5.8.2
Essential Addons for Elementor 5.8.3
Essential Addons for Elementor 5.8.4
Essential Addons for Elementor 5.8.5
Essential Addons for Elementor 5.8.6
Essential Addons for Elementor 5.8.7
Essential Addons for Elementor 5.8.8
Essential Addons for Elementor 5.8.9
Essential Addons for Elementor 5.8.10
Essential Addons for Elementor 5.8.11
Essential Addons for Elementor 5.8.12
Essential Addons for Elementor 5.8.13
Essential Addons for Elementor 5.8.14
Essential Addons for Elementor 5.8.15
Essential Addons for Elementor 5.8.16
Essential Addons for Elementor 5.8.18
Essential Addons for Elementor 5.9.0
Essential Addons for Elementor 5.9.1
Essential Addons for Elementor 5.9.2
Essential Addons for Elementor 5.9.3
Essential Addons for Elementor 5.9.4
Essential Addons for Elementor 5.9.5
Essential Addons for Elementor 5.9.6
Essential Addons for Elementor 5.9.7
Essential Addons for Elementor 5.9.8
Essential Addons for Elementor 5.9.9
Essential Addons for Elementor 5.9.10
Essential Addons for Elementor 5.9.11
Essential Addons for Elementor 5.9.12
Essential Addons for Elementor 5.9.13
Essential Addons for Elementor 5.9.14
Essential Addons for Elementor 5.9.15
Essential Addons for Elementor 5.9.16
Essential Addons for Elementor 5.9.17
Essential Addons for Elementor 5.9.18
Essential Addons for Elementor 5.9.19
Essential Addons for Elementor 5.9.20
Essential Addons for Elementor 5.9.21
Essential Addons for Elementor 5.9.22
Essential Addons for Elementor 5.9.23
Essential Addons for Elementor 5.9.24
Essential Addons for Elementor 5.9.25
Essential Addons for Elementor 5.9.26
Essential Addons for Elementor 5.9.27
Essential Addons for Elementor 6.0.0
Essential Addons for Elementor 6.0.1
Essential Addons for Elementor 6.0.2
Essential Addons for Elementor 6.0.3
Essential Addons for Elementor 6.0.4
Essential Addons for Elementor 6.0.5
Essential Addons for Elementor 6.0.6
Essential Addons for Elementor 6.0.7
Essential Addons for Elementor 6.0.8
Essential Addons for Elementor 6.0.9
Essential Addons for Elementor 6.0.10
Essential Addons for Elementor 6.0.11
Essential Addons for Elementor 6.0.12
Essential Addons for Elementor 6.0.13
Essential Addons for Elementor 6.0.14
Essential Addons for Elementor 6.0.15
Essential Addons for Elementor 6.1.0
Essential Addons for Elementor 6.1.1
Essential Addons for Elementor 6.1.2
Essential Addons for Elementor 6.1.3
Essential Addons for Elementor 6.1.4
Essential Addons for Elementor 6.1.5
Essential Addons for Elementor 6.1.6
Essential Addons for Elementor 6.1.7
Essential Addons for Elementor 6.1.8
Essential Addons for Elementor 6.1.9
Essential Addons for Elementor 6.1.10
Essential Addons for Elementor 6.1.11
Essential Addons for Elementor 6.1.12
Essential Addons for Elementor 6.1.13
Essential Addons for Elementor 6.1.14
Essential Addons for Elementor 6.1.15
Essential Addons for Elementor 6.1.17
Essential Addons for Elementor 6.1.18
Essential Addons for Elementor 6.1.19
Essential Addons for Elementor 6.1.20
Essential Addons for Elementor 6.2.0
Essential Addons for Elementor 6.2.1
Essential Addons for Elementor 6.2.2
Essential Addons for Elementor 6.2.3
Essential Addons for Elementor 6.2.4
Essential Addons for Elementor 6.3.0
Essential Addons for Elementor 6.3.1
Essential Addons for Elementor 6.3.2
Essential Addons for Elementor 6.3.3
Essential Addons for Elementor 6.4.0
Essential Addons for Elementor 6.5.0
Essential Addons for Elementor 6.5.1
Essential Addons for Elementor 6.5.2
Essential Addons for Elementor 6.5.3
Essential Addons for Elementor 6.5.4
Essential Addons for Elementor 6.5.5
Essential Addons for Elementor 6.5.6
Essential Addons for Elementor 6.5.7
Essential Addons for Elementor 6.5.8
Essential Addons for Elementor 6.5.9
Essential Addons for Elementor 6.5.10
Essential Addons for Elementor 6.5.11
Essential Addons for Elementor 6.5.12
Essential Addons for Elementor 6.5.13
Essential Addons for Elementor 6.6.0
Essential Addons for Elementor 6.6.1
Essential Addons for Elementor 6.6.2
Essential Addons for Elementor 6.6.3
Essential Addons for Elementor 6.6.4
Essential Addons for Elementor 6.6.5
Essential Addons for Elementor 6.6.6
Essential Addons for Elementor 6.6.7
Essential Addons for Elementor 6.6.8
Essential Addons for Elementor 6.6.9
Essential Addons for Elementor 6.6.10
Essential Addons for Elementor 6.6.11

iCal export header/line-break injection hardening in iCal generator

Skrevet den 18. august 2026 af i The Events Calendar

The Events Calendar 6.16.4.1 (released June 19, 2026) hardens the iCalendar export feed against header injection and line-break injection. Prior to this fix, the plugin wrote unsanitized values into HTTP response headers and iCal VCALENDAR header fields: the Content-Disposition filename came directly from get_file_name() without sanitization, and the X-WR-CALNAME and X-ORIGINAL-URL fields embedded the unescaped site name/URL (filterable via tribe_ical_feed_calname). An attacker who could influence the site name or the calname filter value could inject CRLF sequences to add arbitrary HTTP headers or spoof iCal fields in the exported .ics file. The fix applies sanitize_file_name() to the Content-Disposition filename, esc_url_raw() to the site URL, and sanitize_text_field() to the calendar name before embedding them in HTTP headers and iCal output. A non-security companion change makes DTSTAMP deterministic (tied to event modified time rather than wall-clock).

This vulnerability affects the following application versions:

The Events Calendar 5.0.0
The Events Calendar 5.0.0.1
The Events Calendar 5.0.0.3
The Events Calendar 5.0.1.1
The Events Calendar 5.0.1.2
The Events Calendar 5.0.2
The Events Calendar 5.0.2.2
The Events Calendar 5.0.3.3
The Events Calendar 5.1.0.1
The Events Calendar 5.1.0.2
The Events Calendar 5.1.1.1
The Events Calendar 5.1.1.2
The Events Calendar 5.1.2.1
The Events Calendar 5.1.3
The Events Calendar 5.1.3.1
The Events Calendar 5.1.4
The Events Calendar 5.1.4.1
The Events Calendar 5.1.5
The Events Calendar 5.1.5.1
The Events Calendar 5.1.6
The Events Calendar 5.1.6.1
The Events Calendar 5.2.0
The Events Calendar 5.2.0.1
The Events Calendar 5.2.1
The Events Calendar 5.2.1.1
The Events Calendar 5.2.1.2
The Events Calendar 5.3.0
The Events Calendar 5.3.0.1
The Events Calendar 5.3.1
The Events Calendar 5.3.1.1
The Events Calendar 5.3.1.2
The Events Calendar 5.3.2
The Events Calendar 5.3.2.1
The Events Calendar 5.3.2.2
The Events Calendar 5.4.0
The Events Calendar 5.4.0.1
The Events Calendar 5.4.0.2
The Events Calendar 5.4.0.3
The Events Calendar 5.5.0
The Events Calendar 5.5.0.1
The Events Calendar 5.5.0.2
The Events Calendar 5.6.0
The Events Calendar 5.7.0
The Events Calendar 5.7.1
The Events Calendar 5.8.0
The Events Calendar 5.8.2
The Events Calendar 5.9.0
The Events Calendar 5.9.1
The Events Calendar 5.9.2
The Events Calendar 5.10.0
The Events Calendar 5.10.1
The Events Calendar 5.11.0
The Events Calendar 5.12.0
The Events Calendar 5.12.2
The Events Calendar 5.12.3
The Events Calendar 5.12.4
The Events Calendar 5.13.0
The Events Calendar 5.14.0
The Events Calendar 5.14.0.1
The Events Calendar 5.14.0.2
The Events Calendar 5.14.0.3
The Events Calendar 5.14.0.4
The Events Calendar 5.14.1
The Events Calendar 5.14.2
The Events Calendar 5.14.2.1
The Events Calendar 5.15.0
The Events Calendar 5.15.0.1
The Events Calendar 5.16.0
The Events Calendar 5.16.1
The Events Calendar 5.16.1.1
The Events Calendar 5.16.2
The Events Calendar 5.16.2.1
The Events Calendar 5.16.3
The Events Calendar 5.16.3.1
The Events Calendar 5.16.4
The Events Calendar 5.16.4.1
The Events Calendar 6.0.0
The Events Calendar 6.0.0.1
The Events Calendar 6.0.1
The Events Calendar 6.0.1.1
The Events Calendar 6.0.2
The Events Calendar 6.0.3
The Events Calendar 6.0.3.1
The Events Calendar 6.0.4
The Events Calendar 6.0.5
The Events Calendar 6.0.6
The Events Calendar 6.0.6.1
The Events Calendar 6.0.6.2
The Events Calendar 6.0.7
The Events Calendar 6.0.7.1
The Events Calendar 6.0.8
The Events Calendar 6.0.9
The Events Calendar 6.0.10
The Events Calendar 6.0.11
The Events Calendar 6.0.12
The Events Calendar 6.0.13
The Events Calendar 6.0.13.1
The Events Calendar 6.1.0
The Events Calendar 6.1.0.1
The Events Calendar 6.1.0.2
The Events Calendar 6.1.1
The Events Calendar 6.1.2
The Events Calendar 6.1.2.1
The Events Calendar 6.1.2.2
The Events Calendar 6.1.3
The Events Calendar 6.1.4
The Events Calendar 6.2.0
The Events Calendar 6.2.0.1
The Events Calendar 6.2.1
The Events Calendar 6.2.2
The Events Calendar 6.2.2.1
The Events Calendar 6.2.3
The Events Calendar 6.2.3.1
The Events Calendar 6.2.3.2
The Events Calendar 6.2.4
The Events Calendar 6.2.5
The Events Calendar 6.2.6
The Events Calendar 6.2.6.1
The Events Calendar 6.2.7
The Events Calendar 6.2.8
The Events Calendar 6.2.8.1
The Events Calendar 6.2.8.2
The Events Calendar 6.3.0
The Events Calendar 6.3.1
The Events Calendar 6.3.3
The Events Calendar 6.3.3.1
The Events Calendar 6.3.4
The Events Calendar 6.3.5
The Events Calendar 6.3.6
The Events Calendar 6.3.7
The Events Calendar 6.4.0
The Events Calendar 6.4.0.1
The Events Calendar 6.5.0
The Events Calendar 6.5.0.1
The Events Calendar 6.5.1
The Events Calendar 6.5.1.1
The Events Calendar 6.5.1.2
The Events Calendar 6.5.1.3
The Events Calendar 6.5.1.4
The Events Calendar 6.5.1.5
The Events Calendar 6.5.1.6
The Events Calendar 6.5.2
The Events Calendar 6.6.0
The Events Calendar 6.6.0.1
The Events Calendar 6.6.0.2
The Events Calendar 6.6.1
The Events Calendar 6.6.2
The Events Calendar 6.6.3
The Events Calendar 6.6.4
The Events Calendar 6.6.4.1
The Events Calendar 6.6.4.2
The Events Calendar 6.7.0
The Events Calendar 6.7.1
The Events Calendar 6.8.0
The Events Calendar 6.8.1
The Events Calendar 6.8.2
The Events Calendar 6.8.2.1
The Events Calendar 6.9.0
The Events Calendar 6.9.1
The Events Calendar 6.10.0
The Events Calendar 6.10.1
The Events Calendar 6.10.3
The Events Calendar 6.11.0.1
The Events Calendar 6.11.1
The Events Calendar 6.11.2
The Events Calendar 6.11.2.1
The Events Calendar 6.13.0
The Events Calendar 6.13.1
The Events Calendar 6.13.2.1
The Events Calendar 6.14.0
The Events Calendar 6.14.1
The Events Calendar 6.14.2
The Events Calendar 6.15.0
The Events Calendar 6.15.0.1
The Events Calendar 6.15.1
The Events Calendar 6.15.1.1
The Events Calendar 6.15.2
The Events Calendar 6.15.3
The Events Calendar 6.15.4
The Events Calendar 6.15.5
The Events Calendar 6.15.6
The Events Calendar 6.15.8
The Events Calendar 6.15.9
The Events Calendar 6.15.10
The Events Calendar 6.15.12
The Events Calendar 6.15.12.1
The Events Calendar 6.15.12.2
The Events Calendar 6.15.13
The Events Calendar 6.15.13.1
The Events Calendar 6.15.14
The Events Calendar 6.15.15
The Events Calendar 6.15.16
The Events Calendar 6.15.17.1
The Events Calendar 6.15.18
The Events Calendar 6.15.19
The Events Calendar 6.15.20
The Events Calendar 6.16.0
The Events Calendar 6.16.1
The Events Calendar 6.16.2
The Events Calendar 6.16.3
The Events Calendar 6.16.4
The Events Calendar 6.16.4.1

Authenticated (Contributor+) Stored XSS in Nested Nav Menu Widget

Skrevet den 18. august 2026 af i Website Builder by SeedProd

A Contributor-level user could inject arbitrary JavaScript via the menu divider (“menudivider”) attribute of the nested navigation menu widget. The injected script executes when a visitor loads any SeedProd-powered page that includes the affected nav-menu block. The fix in `app/nestednavmenu.php` adds `sanitize_text_field()` on the incoming `menudivider` attribute value and wraps the output with `esc_html()` before writing it into the rendered `

` separator element.

This vulnerability affects the following application versions:

Website Builder by SeedProd 6.9.0.8
Website Builder by SeedProd 6.10.0
Website Builder by SeedProd 6.12.0
Website Builder by SeedProd 6.12.2
Website Builder by SeedProd 6.13.0
Website Builder by SeedProd 6.13.1
Website Builder by SeedProd 6.15.3
Website Builder by SeedProd 6.15.4
Website Builder by SeedProd 6.15.6
Website Builder by SeedProd 6.15.7
Website Builder by SeedProd 6.15.13.1
Website Builder by SeedProd 6.15.15.3
Website Builder by SeedProd 6.15.18
Website Builder by SeedProd 6.15.19
Website Builder by SeedProd 6.15.20
Website Builder by SeedProd 6.15.21
Website Builder by SeedProd 6.15.22
Website Builder by SeedProd 6.15.23
Website Builder by SeedProd 6.17.4
Website Builder by SeedProd 6.18.4
Website Builder by SeedProd 6.18.5
Website Builder by SeedProd 6.18.9
Website Builder by SeedProd 6.18.10
Website Builder by SeedProd 6.18.11
Website Builder by SeedProd 6.18.12
Website Builder by SeedProd 6.18.14
Website Builder by SeedProd 6.18.15
Website Builder by SeedProd 6.18.16
Website Builder by SeedProd 6.18.17
Website Builder by SeedProd 6.18.18
Website Builder by SeedProd 6.19.0
Website Builder by SeedProd 6.19.1
Website Builder by SeedProd 6.19.3
Website Builder by SeedProd 6.19.4
Website Builder by SeedProd 6.19.5
Website Builder by SeedProd 6.19.6
Website Builder by SeedProd 6.19.7
Website Builder by SeedProd 6.19.8
Website Builder by SeedProd 6.19.9
Website Builder by SeedProd 6.19.10
Website Builder by SeedProd 6.20.0
Website Builder by SeedProd 6.20.1
Website Builder by SeedProd 6.20.2

Stored XSS in Duplicate Post scheduled republish notice

Skrevet den 18. august 2026 af i Yoast Duplicate Post

Yoast Duplicate Post through 4.6 inserts an unescaped post title and permalink into the Classic Editor scheduled republish notice. Attackers can schedule a republish copy with a crafted title to execute script when an administrator views the resulting notice.

This vulnerability affects the following application versions:

Yoast Duplicate Post 4.2
Yoast Duplicate Post 4.3
Yoast Duplicate Post 4.4
Yoast Duplicate Post 4.5
Yoast Duplicate Post 4.6

Broken Access Control in Pricing Table Builder REST endpoints

Skrevet den 18. august 2026 af i King Addons for Elementor

The `/king-addons/v1/pricing-table/list` and `/king-addons/v1/pricing-table/{id}` REST routes were registered with `’permission_callback’ => ‘__return_true’`, allowing unauthenticated retrieval of pricing-table configurations including draft/unpublished records. The fix in 51.1.63 replaces both permission callbacks with `current_user_can(‘manage_options’)` and additionally adds a per-record check that rejects non-published tables unless the caller has `edit_post` on that specific table.

This vulnerability affects the following application versions:

King Addons for Elementor 51.1.44
King Addons for Elementor 51.1.45
King Addons for Elementor 51.1.46
King Addons for Elementor 51.1.47
King Addons for Elementor 51.1.49
King Addons for Elementor 51.1.51
King Addons for Elementor 51.1.52
King Addons for Elementor 51.1.53
King Addons for Elementor 51.1.54
King Addons for Elementor 51.1.55
King Addons for Elementor 51.1.56
King Addons for Elementor 51.1.57
King Addons for Elementor 51.1.58
King Addons for Elementor 51.1.59
King Addons for Elementor 51.1.60
King Addons for Elementor 51.1.61
King Addons for Elementor 51.1.62

Stored Cross-Site Scripting in Ninja Forms Repeatable Fieldset

Skrevet den 18. august 2026 af i Ninja Forms – The Contact Form Builder

Ninja Forms before 3.14.9 does not escape the repetition index when rendering the submission summary for Repeatable Fieldset fields. An attacker who can manipulate form submission data may inject HTML or JavaScript that executes in the browser of anyone viewing the submission, such as site administrators reviewing entries. Sites using the Repeatable Fieldset feature on public forms are at risk.

This vulnerability affects the following application versions:

Ninja Forms – The Contact Form Builder 3.8.3
Ninja Forms – The Contact Form Builder 3.8.4
Ninja Forms – The Contact Form Builder 3.8.5
Ninja Forms – The Contact Form Builder 3.8.6
Ninja Forms – The Contact Form Builder 3.8.7
Ninja Forms – The Contact Form Builder 3.8.8
Ninja Forms – The Contact Form Builder 3.8.9
Ninja Forms – The Contact Form Builder 3.8.10
Ninja Forms – The Contact Form Builder 3.8.11
Ninja Forms – The Contact Form Builder 3.8.12
Ninja Forms – The Contact Form Builder 3.8.13
Ninja Forms – The Contact Form Builder 3.8.14
Ninja Forms – The Contact Form Builder 3.8.15
Ninja Forms – The Contact Form Builder 3.8.16
Ninja Forms – The Contact Form Builder 3.8.17
Ninja Forms – The Contact Form Builder 3.8.18
Ninja Forms – The Contact Form Builder 3.8.19
Ninja Forms – The Contact Form Builder 3.8.20
Ninja Forms – The Contact Form Builder 3.8.21
Ninja Forms – The Contact Form Builder 3.8.22
Ninja Forms – The Contact Form Builder 3.8.23
Ninja Forms – The Contact Form Builder 3.8.24
Ninja Forms – The Contact Form Builder 3.8.25
Ninja Forms – The Contact Form Builder 3.8.25.1
Ninja Forms – The Contact Form Builder 3.9.0
Ninja Forms – The Contact Form Builder 3.9.1
Ninja Forms – The Contact Form Builder 3.9.2
Ninja Forms – The Contact Form Builder 3.9.2.1
Ninja Forms – The Contact Form Builder 3.10.0
Ninja Forms – The Contact Form Builder 3.10.1
Ninja Forms – The Contact Form Builder 3.10.2
Ninja Forms – The Contact Form Builder 3.10.2.1
Ninja Forms – The Contact Form Builder 3.10.2.2
Ninja Forms – The Contact Form Builder 3.10.3
Ninja Forms – The Contact Form Builder 3.10.4
Ninja Forms – The Contact Form Builder 3.10.4.1
Ninja Forms – The Contact Form Builder 3.11.0
Ninja Forms – The Contact Form Builder 3.11.1
Ninja Forms – The Contact Form Builder 3.11.1.1
Ninja Forms – The Contact Form Builder 3.12.0
Ninja Forms – The Contact Form Builder 3.12.1
Ninja Forms – The Contact Form Builder 3.12.2
Ninja Forms – The Contact Form Builder 3.12.2.1
Ninja Forms – The Contact Form Builder 3.13.0
Ninja Forms – The Contact Form Builder 3.13.1
Ninja Forms – The Contact Form Builder 3.13.2
Ninja Forms – The Contact Form Builder 3.13.3
Ninja Forms – The Contact Form Builder 3.13.4
Ninja Forms – The Contact Form Builder 3.14.0
Ninja Forms – The Contact Form Builder 3.14.1
Ninja Forms – The Contact Form Builder 3.14.2
Ninja Forms – The Contact Form Builder 3.14.3
Ninja Forms – The Contact Form Builder 3.14.4
Ninja Forms – The Contact Form Builder 3.14.5
Ninja Forms – The Contact Form Builder 3.14.6
Ninja Forms – The Contact Form Builder 3.14.7
Ninja Forms – The Contact Form Builder 3.14.8

Authenticated (Administrator+) SQL Injection via Import File ‘settings’ Key

Skrevet den 18. august 2026 af i Ninja Forms – The Contact Form Builder

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to generic SQL Injection via Import File ‘settings’ Key in all versions up to, and including, 3.14.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable keys originate from the ‘settings’ object in an attacker-controlled import file processed via file_get_contents() or base64-decoded/JSON-decoded blobs, bypassing wp_magic_quotes protections entirely; two distinct sinks are affected — _save_setting() in Model.php and insert_form_meta() in ImportForm.php — as only the value side is escaped while the key side receives no sanitization or parameterization at any point in the call chain.

This vulnerability affects the following application versions:

Ninja Forms – The Contact Form Builder 3.8.1
Ninja Forms – The Contact Form Builder 3.8.2
Ninja Forms – The Contact Form Builder 3.8.3
Ninja Forms – The Contact Form Builder 3.8.4
Ninja Forms – The Contact Form Builder 3.8.5
Ninja Forms – The Contact Form Builder 3.8.6
Ninja Forms – The Contact Form Builder 3.8.7
Ninja Forms – The Contact Form Builder 3.8.8
Ninja Forms – The Contact Form Builder 3.8.9
Ninja Forms – The Contact Form Builder 3.8.10
Ninja Forms – The Contact Form Builder 3.8.11
Ninja Forms – The Contact Form Builder 3.8.12
Ninja Forms – The Contact Form Builder 3.8.13
Ninja Forms – The Contact Form Builder 3.8.14
Ninja Forms – The Contact Form Builder 3.8.15
Ninja Forms – The Contact Form Builder 3.8.16
Ninja Forms – The Contact Form Builder 3.8.17
Ninja Forms – The Contact Form Builder 3.8.18
Ninja Forms – The Contact Form Builder 3.8.19
Ninja Forms – The Contact Form Builder 3.8.20
Ninja Forms – The Contact Form Builder 3.8.21
Ninja Forms – The Contact Form Builder 3.8.22
Ninja Forms – The Contact Form Builder 3.8.23
Ninja Forms – The Contact Form Builder 3.8.24
Ninja Forms – The Contact Form Builder 3.8.25
Ninja Forms – The Contact Form Builder 3.8.25.1
Ninja Forms – The Contact Form Builder 3.9.0
Ninja Forms – The Contact Form Builder 3.9.1
Ninja Forms – The Contact Form Builder 3.9.2
Ninja Forms – The Contact Form Builder 3.9.2.1
Ninja Forms – The Contact Form Builder 3.10.0
Ninja Forms – The Contact Form Builder 3.10.1
Ninja Forms – The Contact Form Builder 3.10.2
Ninja Forms – The Contact Form Builder 3.10.2.1
Ninja Forms – The Contact Form Builder 3.10.2.2
Ninja Forms – The Contact Form Builder 3.10.3
Ninja Forms – The Contact Form Builder 3.10.4
Ninja Forms – The Contact Form Builder 3.10.4.1
Ninja Forms – The Contact Form Builder 3.11.0
Ninja Forms – The Contact Form Builder 3.11.1
Ninja Forms – The Contact Form Builder 3.11.1.1
Ninja Forms – The Contact Form Builder 3.12.0
Ninja Forms – The Contact Form Builder 3.12.1
Ninja Forms – The Contact Form Builder 3.12.2
Ninja Forms – The Contact Form Builder 3.12.2.1
Ninja Forms – The Contact Form Builder 3.13.0
Ninja Forms – The Contact Form Builder 3.13.1
Ninja Forms – The Contact Form Builder 3.13.2
Ninja Forms – The Contact Form Builder 3.13.3
Ninja Forms – The Contact Form Builder 3.13.4
Ninja Forms – The Contact Form Builder 3.14.0
Ninja Forms – The Contact Form Builder 3.14.1
Ninja Forms – The Contact Form Builder 3.14.2
Ninja Forms – The Contact Form Builder 3.14.3
Ninja Forms – The Contact Form Builder 3.14.4
Ninja Forms – The Contact Form Builder 3.14.5
Ninja Forms – The Contact Form Builder 3.14.6
Ninja Forms – The Contact Form Builder 3.14.7
Ninja Forms – The Contact Form Builder 3.14.8
Ninja Forms – The Contact Form Builder 3.14.9

Unauthenticated Privilege Escalation in Duplicator One-Click Upgrade

Skrevet den 18. august 202628. august 2026 af i Duplicator

The Duplicator plugin registered its one-click upgrade AJAX endpoint for unauthenticated visitors and only required a low-privilege capability to use it. An attacker without an account could trigger the upgrade flow and make the site install and activate a malicious plugin package, leading to remote code execution and full site takeover.

This vulnerability affects the following application versions:

Duplicator 1.5.5
Duplicator 1.5.5.1
Duplicator 1.5.6
Duplicator 1.5.6.1
Duplicator 1.5.7
Duplicator 1.5.7.1
Duplicator 1.5.8
Duplicator 1.5.8.1
Duplicator 1.5.9
Duplicator 1.5.10
Duplicator 1.5.10.1
Duplicator 1.5.10.2
Duplicator 1.5.11
Duplicator 1.5.11.1
Duplicator 1.5.11.2
Duplicator 1.5.12
Duplicator 1.5.13
Duplicator 1.5.13.1
Duplicator 1.5.13.2
Duplicator 1.5.13.3
Duplicator 1.5.14
Duplicator 1.5.15
Duplicator 1.5.16
Duplicator 1.5.17

JavaScript-context injection hardening for redirect URL in Debug Redirections

Skrevet den 18. august 2026 af i Rank Math SEO

Improper Neutralization in a JavaScript context — CWE-79 (hardening). No CVE assigned at time of writing (1.0.275 released 2026-07-28). The upstream changelog states: “Strengthened the security of the Debug redirections feature of the plugin.”

The redirection debugger renders an inline