# cve.now: Devitemsllc

The newest entries naming Devitemsllc as an affected vendor (up to 200), of 52 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-111318](https://cve.now/CVE-2026-111318.md): HT Mega Addons for Elementor \<= 3.2.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Tabs Widget href DOM Sink (CVSS 5.4)
- [CVE-2026-11895](https://cve.now/CVE-2026-11895.md): HT Mega Addons for Elementor \<= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table 'display\_options' Setting (CVSS 6.4)
- [CVE-2026-92554](https://cve.now/CVE-2026-92554.md): ShopLentor \<= 3.5.1 - Reflected Cross-Site Scripting via Query-String Parameter Name (CVSS 6.1)
- [CVE-2026-19806](https://cve.now/CVE-2026-19806.md): Support Genix \<= 1.4.52 - Authenticated (Subscriber+) Authentication Bypass to Administrator Account Takeover via 'p' Parameter Forged Guest Token (CVSS 8.8)
- [CVE-2026-6020](https://cve.now/CVE-2026-6020.md): ShopLentor \<= 3.3.7 - Authenticated (Administrator+) Arbitrary Function Execution via 'callback' Parameter via REST API (CVSS 7.2)
- [CVE-2026-16811](https://cve.now/CVE-2026-16811.md): ShopLentor \<= 3.4.5 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter (CVSS 4.9)
- [CVE-2026-16797](https://cve.now/CVE-2026-16797.md): ShopLentor \<= 3.4.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'optionSection' Parameter (CVSS 4.3)
- [CVE-2026-12936](https://cve.now/CVE-2026-12936.md): Recurio \<= 1.1.3 - Authenticated (Shop Manager+) SQL Injection via 'data' Parameter (CVSS 4.9)
- [CVE-2026-6287](https://cve.now/CVE-2026-6287.md): ShopLentor - WooCommerce Builder for Elementor & Gutenberg \<= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Product Grid 'blockUniqId' Block Attribute (CVSS 5.4)
- [CVE-2026-4059](https://cve.now/CVE-2026-4059.md): ShopLentor \<= 3.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button\_text' Shortcode Attribute (CVSS 6.4)
- [CVE-2026-1714](https://cve.now/CVE-2026-1714.md): ShopLentor \<= 3.3.2 - Unauthenticated Email Relay Abuse via 'woolentor\_suggest\_price\_action' AJAX Action (CVSS 8.6)
- [CVE-2025-13141](https://cve.now/CVE-2025-13141.md): HT Mega – Absolute Addons For Elementor \<= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tag Attribute Injection (CVSS 6.4)
- [CVE-2025-12493](https://cve.now/CVE-2025-12493.md): ShopLentor \<= 3.2.5 - Unauthenticated Local PHP File Inclusion via 'load\_template' (CVSS 9.8)
- [CVE-2025-11823](https://cve.now/CVE-2025-11823.md): ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution \<= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2025-8068](https://cve.now/CVE-2025-8068.md): HT Mega – Absolute Addons For Elementor \<= 2.9.1 - Improper Authorization to Authenticated (Contributor+) Limited Administrator Actions (CVSS 4.3)
- [CVE-2025-8401](https://cve.now/CVE-2025-8401.md): HT Mega – Absolute Addons For Elementor \<= 2.9.1 - Authenticated (Author+) Sensitive Information Exposure (CVSS 4.3)
- [CVE-2025-8151](https://cve.now/CVE-2025-8151.md): HT Mega – Absolute Addons For Elementor \<= 2.9.1 - Authenticated (Author+) Path Traversal to Limited Arbitrary CSS File Actions (CVSS 4.3)
- [CVE-2025-3775](https://cve.now/CVE-2025-3775.md): ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) \<= 3.1.2 - Unauthenticated Server-Side Request Forgery via URL Parameter (CVSS 6.5)
- [CVE-2025-1802](https://cve.now/CVE-2025-1802.md): HT Mega – Absolute Addons For Elementor \<= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 6.4)
- [CVE-2025-1527](https://cve.now/CVE-2025-1527.md): ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) \<= 3.1.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Flash Sale Countdown Module (CVSS 6.4)
- [CVE-2025-1261](https://cve.now/CVE-2025-1261.md): HT Mega – Absolute Addons For Elementor \<= 2.8.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Countdown Widget (CVSS 6.4)
- [CVE-2024-12599](https://cve.now/CVE-2024-12599.md): HT Mega – Absolute Addons For Elementor \<= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget (CVSS 6.4)
- [CVE-2024-12597](https://cve.now/CVE-2024-12597.md): HT Mega \<= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via block\_css and inner\_css (CVSS 6.4)
- [CVE-2024-13216](https://cve.now/CVE-2024-13216.md): HT Event – WordPress Event Manager Plugin for Elementor \<= 1.4.7 - Authenticated (Contributor+) Sensitive Information Exposure via HT Event: Sponsor (CVSS 4.3)
- [CVE-2024-9538](https://cve.now/CVE-2024-9538.md): ShopLentor \<= 2.9.8 - Authenticated (Contributor+) Sensitive Information Exposure via WL: FAQ Widget Elementor Template (CVSS 4.3)
- [CVE-2024-8910](https://cve.now/CVE-2024-8910.md): HT Mega – Absolute Addons For Elementor \<= 2.6.5 - Authenticated (Contributor+) Sensitive Information Exposure via template\_id (CVSS 4.3)
- [CVE-2024-8668](https://cve.now/CVE-2024-8668.md): ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) \<= 2.9.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-5215](https://cve.now/CVE-2024-5215.md): HT Mega – Absolute Addons For Elementor \<= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 6.4)
- [CVE-2024-5173](https://cve.now/CVE-2024-5173.md): HT Mega – Absolute Addons For Elementor \<= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Player Widget Settings (CVSS 6.4)
- [CVE-2024-5530](https://cve.now/CVE-2024-5530.md): ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) \<= 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Product Horizontal Filter Widget (CVSS 6.4)
- [CVE-2024-4876](https://cve.now/CVE-2024-4876.md): HT Mega – Absolute Addons For Elementor \<= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-3345](https://cve.now/CVE-2024-3345.md): ShopLentor \<= 2.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via woolentorsearch Shortcode (CVSS 6.4)
- [CVE-2024-4566](https://cve.now/CVE-2024-4566.md): ShopLentor \<= 2.8.8 - Missing Authorization to WordPress Option Modification (CVSS 7.1)
- [CVE-2024-4875](https://cve.now/CVE-2024-4875.md): HT Mega – Absolute Addons For Elementor \<= 2.5.2 - Missing Authorization to Options Update (CVSS 4.3)
- [CVE-2024-3990](https://cve.now/CVE-2024-3990.md): HT Mega – Absolute Addons For Elementor \<= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip & Popover Widget (CVSS 6.4)
- [CVE-2023-6327](https://cve.now/CVE-2023-6327.md): ShopLentor (formerly WooLentor) \<= 2.8.7 - Missing Authorization via purchased\_new\_products (CVSS 5.3)
- [CVE-2024-3989](https://cve.now/CVE-2024-3989.md): HT Mega – Absolute Addons For Elementor \<= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Justify (CVSS 6.4)
- [CVE-2024-3307](https://cve.now/CVE-2024-3307.md): HT Mega – Absolute Addons For Elementor \<= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget (CVSS 6.4)
- [CVE-2024-2084](https://cve.now/CVE-2024-2084.md): HT Mega – Absolute Addons For Elementor \<= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lightbox Widget (CVSS 6.4)
- [CVE-2023-7067](https://cve.now/CVE-2023-7067.md): ShopLentor \<= 2.8.1 - Improper Authorization via woolentor\_template\_store (CVSS 4.3)
- [CVE-2024-3991](https://cve.now/CVE-2024-3991.md): ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) \<= 2.8.7 - Authenticated (contributor+) Stored Cross-Site Scripting via \_id (CVSS 6.4)
- [CVE-2023-6214](https://cve.now/CVE-2023-6214.md): HT Mega – Absolute Addons For Elementor \<= 2.4.6 - Sensitive Information Exposure via purchased\_products (CVSS 7.5)
- [CVE-2024-2790](https://cve.now/CVE-2024-2790.md): HT Mega – Absolute Addons For Elementor \<= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion/FAQ (CVSS 6.4)
- [CVE-2024-3308](https://cve.now/CVE-2024-3308.md): HT Mega – Absolute Addons For Elementor \<= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Grid Widget (CVSS 6.4)
- [CVE-2024-2085](https://cve.now/CVE-2024-2085.md): HT Mega – Absolute Addons For Elementor \<= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' (CVSS 6.4)
- [CVE-2024-1057](https://cve.now/CVE-2024-1057.md): ShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (formerly WooLentor) \<= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-2946](https://cve.now/CVE-2024-2946.md): ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) \<= 2.8.4 - Authenticated (Contributor+) Stored Cross-site Scripting via QR Code Widget (CVSS 6.4)
- [CVE-2024-1960](https://cve.now/CVE-2024-1960.md): ShopLentor \<= 2.8.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Banner Link (CVSS 6.4)
- [CVE-2024-1974](https://cve.now/CVE-2024-1974.md): HT Mega – Absolute Addons For Elementor \<= 2.4.5 - Authenticated (Contributor+) Directory Traversal (CVSS 8.8)
- [CVE-2024-2868](https://cve.now/CVE-2024-2868.md): ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) \<= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Universal Product Layout (CVSS 6.4)
- [CVE-2024-1421](https://cve.now/CVE-2024-1421.md): HT Mega – Absolute Addons For Elementor \<= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Carousel Widget (CVSS 6.4)
- [CVE-2024-1397](https://cve.now/CVE-2024-1397.md): HT Mega \<= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleTag (CVSS 6.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/devitemsllc
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.