# cve.now: Posimyththemes

The newest entries naming Posimyththemes as an affected vendor (up to 200), of 42 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-109385](https://cve.now/CVE-2026-109385.md): UiChemy \<= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slot Link URL (CVSS 6.4)
- [CVE-2026-111114](https://cve.now/CVE-2026-111114.md): Nexter Extension \<= 4.7.11 - Authenticated (Subscriber+) Privilege Escalation to 'reset-view' Parameter (CVSS 7.5)
- [CVE-2026-15420](https://cve.now/CVE-2026-15420.md): Nexter Blocks \<= 5.0.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary CSS/JS File Deletion via 'plus\_name' Parameter (CVSS 4.3)
- [CVE-2026-15285](https://cve.now/CVE-2026-15285.md): The Plus Addons for Elementor \<= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes (CVSS 6.4)
- [CVE-2026-6740](https://cve.now/CVE-2026-6740.md): Nexter Blocks \<= 4.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'commentIcon' Block Attribute (CVSS 6.4)
- [CVE-2026-9243](https://cve.now/CVE-2026-9243.md): The Plus Addons for Elementor \<= 6.4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'carousel\_direction' Parameter (CVSS 6.4)
- [CVE-2026-5243](https://cve.now/CVE-2026-5243.md): The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce \<= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Lite Widget (CVSS 6.4)
- [CVE-2026-3311](https://cve.now/CVE-2026-3311.md): The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce \<= 6.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar (CVSS 6.4)
- [CVE-2026-2385](https://cve.now/CVE-2026-2385.md): The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce \<= 6.4.7 - Unauthenticated Email Relay (CVSS 5.3)
- [CVE-2026-2386](https://cve.now/CVE-2026-2386.md): The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce \<= 6.4.7 - Incorrect Authorization to Authenticated (Author+) Arbitrary Draft Post Creation via 'post\_type' (CVSS 4.3)
- [CVE-2026-0726](https://cve.now/CVE-2026-0726.md): Nexter Extension – Site Enhancements Toolkit \<= 4.4.6 - Unauthenticated PHP Object Injection via 'nxt\_unserialize\_replace' (CVSS 8.1)
- [CVE-2025-13731](https://cve.now/CVE-2025-13731.md): Nexter Extension \<= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2025-9029](https://cve.now/CVE-2025-9029.md): WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder \<= 1.2.16 - Missing Authentication via wdkit\_handle\_review\_submission Function (CVSS 4.3)
- [CVE-2025-8567](https://cve.now/CVE-2025-8567.md): Nexter Blocks \<= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 6.4)
- [CVE-2025-7646](https://cve.now/CVE-2025-7646.md): The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce \<= 6.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-12189](https://cve.now/CVE-2024-12189.md): WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder \<= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2025-1287](https://cve.now/CVE-2025-1287.md): The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce \<= 6.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 6.4)
- [CVE-2024-11829](https://cve.now/CVE-2024-11829.md): The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce \<= 6.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-5020](https://cve.now/CVE-2024-5020.md): Multiple Plugins \<= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library (CVSS 6.4)
- [CVE-2024-10365](https://cve.now/CVE-2024-10365.md): The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce \<= 6.0.3 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates (CVSS 4.3)
- [CVE-2024-8913](https://cve.now/CVE-2024-8913.md): The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce \<= 5.6.11 - Authenticated (Contributor+) Sensitive Information Exposure via content\_template (CVSS 4.3)
- [CVE-2024-5583](https://cve.now/CVE-2024-5583.md): The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce \<= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonials Widget Settings (CVSS 6.4)
- [CVE-2024-6575](https://cve.now/CVE-2024-6575.md): The Plus Addons for Elementor \<= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via TP Page Scroll Widget (CVSS 6.4)
- [CVE-2024-5763](https://cve.now/CVE-2024-5763.md): The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce \<= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Widget (CVSS 6.4)
- [CVE-2024-4482](https://cve.now/CVE-2024-4482.md): The Plus Addons for Elementor \<= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget (CVSS 6.4)
- [CVE-2024-4983](https://cve.now/CVE-2024-4983.md): The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce \<= 5.6.0- Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-5455](https://cve.now/CVE-2024-5455.md): The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce \<= 5.5.6 - Authenticated (Contributor+) Local File Inclusion (CVSS 8.8)
- [CVE-2024-5344](https://cve.now/CVE-2024-5344.md): The Plus Addons for Elementor Page Builder \<= 5.5.6 - Reflected Cross-Site Scripting via WP Login and Register Widget (CVSS 6.1)
- [CVE-2024-5341](https://cve.now/CVE-2024-5341.md): The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce \<= 5.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading Title Widget (CVSS 6.4)
- [CVE-2024-4484](https://cve.now/CVE-2024-4484.md): The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce \<= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-4485](https://cve.now/CVE-2024-4485.md): The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce \<= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-3718](https://cve.now/CVE-2024-3718.md): The Plus Addons for Elementor \<= 5.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar, Header Meta Content, Scroll Navigation, Pricing Table, & Flip Box (CVSS 6.4)
- [CVE-2024-2784](https://cve.now/CVE-2024-2784.md): The Plus Addons for Elementor \<= 5.5.4 - Authenticated (Contibutor+) Stored Cross-Site Scripting via Hover Card (CVSS 6.4)
- [CVE-2024-2785](https://cve.now/CVE-2024-2785.md): The Plus Addons for Elementor \<= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Age Gate (CVSS 6.4)
- [CVE-2024-0445](https://cve.now/CVE-2024-0445.md): The Plus Addons for Elementor \<= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-3197](https://cve.now/CVE-2024-3197.md): The Plus Addons for Elementor \<= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes (CVSS 6.4)
- [CVE-2024-3199](https://cve.now/CVE-2024-3199.md): The Plus Addons for Elementor \<= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget (CVSS 6.4)
- [CVE-2024-2203](https://cve.now/CVE-2024-2203.md): The Plus Addons for Elementor \<= 5.4.1 - Authenticated (Contributor+) Local File Inclusion via Clients Widget (CVSS 6.4)
- [CVE-2024-2210](https://cve.now/CVE-2024-2210.md): The Plus Addons for Elementor \<= 5.4.1 - Authenticated (Contributor+) Local File Inclusion via Team Member Listing (CVSS 6.4)
- [CVE-2024-1419](https://cve.now/CVE-2024-1419.md): The Plus Addons for Elementor \<= 5.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Header Meta Content Widget (CVSS 6.4)
- [CVE-2021-4332](https://cve.now/CVE-2021-4332.md): The Plus Addons for Elementor PRO \<= 4.1.9 & The Plus Addons for Elementor \<= 2.0.6 - Authenticated (Contributor+) Arbitrary File Read (CVSS 6.5)
- [CVE-2021-4331](https://cve.now/CVE-2021-4331.md): The Plus Addons for Elementor PRO \<= 4.1.9 & The Plus Addons for Elementor \<= 2.0.6 - Authenticated (Contributor+) Privilege Escalation (CVSS 8.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/posimyththemes
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.