Extension WordPress
Vulnérabilités The Plus Addons for Elementor Page Builder Pro
Cette page rassemble les failles publiées pour The Plus Addons for Elementor Page Builder Pro, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de The Plus Addons for Elementor Page Builder Pro
13 fiches
The Plus Addons for Elementor Pro < 6.3.7 – Missing Authorization
The The Plus Addons for Elementor Page Builder Pro plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to 6.3.7 (exclusive). This makes it possible for…
[*, 6.3.7)
6.3.7
16/07/2025
The Plus Addons for Elementor Pro <= 6.3.6 – Missing Authorization
The The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 6.3.6. This makes it possible for…
*-6.3.6
6.3.7
20/05/2025
The Plus Addons for Elementor Page Builder <= 5.5.6 – Reflected Cross-Site Scripting via WP Login and Register Widget
The The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘forgoturl’ attribute within the plugin's WP Login & Register widget in all versions up to, and including, 5.5.6 due…
*-5.5.6
5.6.0
20/06/2024
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.6 – Authenticated (Contributor+) Local File Inclusion
The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.5.4 via the 'magazine_style' parameter within the Dynamic Smart Showcase widget. This makes it possible…
*-5.5.6
5.6.0
20/06/2024
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via Heading Title Widget
The The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'size' attribute of the Heading Title widget in all versions up to, and including, 5.5.4 due to insufficient input…
*-5.5.4
5.5.5
29/05/2024
The Plus Addons for Elementor Pro <= 5.2.8 – Unauthenticated Local File Inclusion
The The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.2.8 via an unknown parameter. This makes it possible for unauthenticated attackers to include…
*-5.2.8
5.2.9
31/10/2023
The Plus Addons for Elementor – Pro <= 5.0.6 – SQL Injection
The "WP Search Filters" widget of The Plus Addons for Elementor – Pro WordPress plugin before 5.0.7 does not sanitise and escape the option parameter before using it in a SQL statement, which could lead to SQL injection
[*, 5.0.7)
5.0.7
13/12/2021
The Plus Addons for Elementor Pro <= 5.0.6 – Sensitive Data Disclosure
The Plus Addons for Elementor – Pro WordPress plugin before 5.0.7 does not validate the qvquery parameter of the tp_get_dl_post_info_ajax AJAX action, which could allow unauthenticated users to retrieve sensitive information, such as private and draft posts
[*, 5.0.7)
5.0.7
13/12/2021
The Plus Addons for Elementor Page Builder <= 4.1.11 – Reflected Cross-Site Scripting
The theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.12 did not properly sanitise some of its fields, leading to a reflected Cross-Site Scripting (exploitable on both unauthenticated and authenticated users)
[*, 4.1.12)
4.1.12
31/05/2021
The Plus Addons for Elementor Page Builder <= 4.1.10 – Open Redirect
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.11 did not properly check that a user requesting a password reset was the legitimate user, allowing an attacker to send an arbitrary reset password email to a…
[*, 4.1.11)
4.1.11
31/05/2021
The Plus Addons for Elementor Page Builder < 4.1.10 – Open Redirect
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.10 did not validate a redirect parameter on a specifically crafted URL before redirecting the user to it, leading to an Open Redirect issue.
[*, 4.1.10)
4.1.10
31/05/2021
The Plus Addons for Elementor PRO <= 4.1.9 & The Plus Addons for Elementor <= 2.0.6 – Authenticated (Contributor+) Privilege Escalation
The Plus Addons for Elementor plugin for WordPress is vulnerable to privilege escalation in versions up to, and including 4.1.9 (pro) and 2.0.6 (free). The plugin adds a registration form to the Elementor page builders functionality. As part…
*-4.1.9
4.1.10
14/04/2021
Plus Addons for Elementor Page Builder <= 4.1.6 – Authentication Bypass
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.7 was being actively exploited to by malicious actors to bypass authentication, allowing unauthenticated users to log in as any user (including admin) by just providing the related…
[*, 4.1.7)
4.1.7
08/03/2021
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.