# cve.now: Wpdevteam The newest entries naming Wpdevteam as an affected vendor (up to 200), of 115 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md. - [CVE-2026-112365](https://cve.now/CVE-2026-112365.md): easy.jobs \<= 2.8.4 - Unauthenticated Stored Cross-Site Scripting via 'cover\_letter' Parameter (CVSS 7.2) - [CVE-2026-118205](https://cve.now/CVE-2026-118205.md): Essential Addons for Elementor \<= 6.8.7 - Unauthenticated Privilege Escalation to 'page\_id' Parameter via Elementor Revision (CVSS 7.4) - [CVE-2026-108366](https://cve.now/CVE-2026-108366.md): easy.jobs \<= 2.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Block Attribute (CVSS 6.4) - [CVE-2026-109985](https://cve.now/CVE-2026-109985.md): xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN \<= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post\_content' Parameter (CVSS 6.4) - [CVE-2026-109513](https://cve.now/CVE-2026-109513.md): NotificationX \<= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route (CVSS 7.2) - [CVE-2026-110721](https://cve.now/CVE-2026-110721.md): NotificationX \<= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Injection via 'nx\_id' Parameter on /popup-submit REST Route (CVSS 5.3) - [CVE-2026-92727](https://cve.now/CVE-2026-92727.md): EmbedPress \<= 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slidesShow' Block Attribute (CVSS 6.4) - [CVE-2026-96256](https://cve.now/CVE-2026-96256.md): Gutenberg Essential Blocks \<= 6.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker' Attribute (CVSS 6.4) - [CVE-2026-89330](https://cve.now/CVE-2026-89330.md): EmbedPress \<= 4.6.5 - Reflected Cross-Site Scripting via 'hash' and 'unique' Parameters (CVSS 6.1) - [CVE-2026-75980](https://cve.now/CVE-2026-75980.md): BetterDocs \<= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content (CVSS 6.4) - [CVE-2026-19801](https://cve.now/CVE-2026-19801.md): BetterLinks \<= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Short URL Creation via create\_fbs\_link AJAX Action (CVSS 4.3) - [CVE-2026-18438](https://cve.now/CVE-2026-18438.md): Templately \<= 3.7.1 - Authenticated (Contributor+) Arbitrary File Upload to Remote Code Execution via Gutenberg Cloud Import Attachment Filename Mismatch (CVSS 8.8) - [CVE-2026-15145](https://cve.now/CVE-2026-15145.md): Essential Addons for Elementor \<= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget (CVSS 6.4) - [CVE-2026-15156](https://cve.now/CVE-2026-15156.md): Essential Addons for Elementor \<= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Reading Progress Global Color Settings (CVSS 6.4) - [CVE-2026-15155](https://cve.now/CVE-2026-15155.md): Essential Addons for Elementor \<= 6.6.10 - Authenticated (Contributor+) Account Takeover via Email Header Injection (CVSS 8.8) - [CVE-2026-15104](https://cve.now/CVE-2026-15104.md): BetterDocs \<= 4.6.0 - Authenticated (Custom+) SQL Injection via 'lang' Parameter (CVSS 6.5) - [CVE-2026-6459](https://cve.now/CVE-2026-6459.md): Essential Addons for Elementor \<= 6.6.2 - Authenticated (Author+) Stored Cross-Site Scripting via Event Calendar Widget Popup (CVSS 6.4) - [CVE-2026-10833](https://cve.now/CVE-2026-10833.md): Gutenberg Essential Blocks - Page Builder for Gutenberg Blocks & Patterns \<= 6.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'configurablePrefix' Block Attribute (CVSS 6.4) - [CVE-2026-12157](https://cve.now/CVE-2026-12157.md): BetterDocs \<= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'blockId' Block Attribute (CVSS 6.4) - [CVE-2026-7796](https://cve.now/CVE-2026-7796.md): EmbedPress \<= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block 'url' Attribute (CVSS 6.4) - [CVE-2026-7665](https://cve.now/CVE-2026-7665.md): Essential Addons for Elementor \<= 6.6.4 - Missing Authorization to Unauthenticated Information Exposure via 'load\_more' AJAX Handler (CVSS 5.3) - [CVE-2026-10586](https://cve.now/CVE-2026-10586.md): Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns \<= 6.1.3 - Authenticated (Author+) Server-Side Request Forgery (CVSS 7.2) - [CVE-2026-5193](https://cve.now/CVE-2026-5193.md): Essential Addons for Elementor – Popular Elementor Templates & Widgets \<= 6.5.13 - Authenticated (Author+) Limited Privilege Escalation via register\_user (CVSS 6.5) - [CVE-2026-4658](https://cve.now/CVE-2026-4658.md): Gutenberg Essential Blocks \<= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes (CVSS 6.4) - [CVE-2026-6393](https://cve.now/CVE-2026-6393.md): BetterDocs \<= 4.3.11 - Missing Authorization to Authenticated (Subscriber+) Unauthorized AI API Usage (CVSS 4.3) - [CVE-2026-3875](https://cve.now/CVE-2026-3875.md): BetterDocs \<= 4.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4) - [CVE-2026-1512](https://cve.now/CVE-2026-1512.md): Essential Addons for Elementor \<= 6.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box Widget (CVSS 6.4) - [CVE-2026-0554](https://cve.now/CVE-2026-0554.md): NotificationX \<= 3.1.11 - Missing Authorization to Authenticated (Contributor+) Analytics Reset (CVSS 4.3) - [CVE-2025-15380](https://cve.now/CVE-2025-15380.md): NotificationX \<= 3.2.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'nx-preview' (CVSS 7.2) - [CVE-2026-1004](https://cve.now/CVE-2026-1004.md): Essential Addons for Elementor \<= 6.5.5 - Missing Authorization to Unauthenticated Sensitive Information Exposure (CVSS 5.3) - [CVE-2026-0831](https://cve.now/CVE-2026-0831.md): Templately \<= 3.4.8 - Unauthenticated Limited Arbitrary JSON File Write (CVSS 5.3) - [CVE-2025-14980](https://cve.now/CVE-2025-14980.md): BetterDocs \<= 4.3.3 - Authenticated (Contributor+) Sensitive Information Exposure (CVSS 6.5) - [CVE-2025-13977](https://cve.now/CVE-2025-13977.md): Essential Addons for Elementor – Popular Elementor Templates & Widgets \<= 6.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4) - [CVE-2025-11369](https://cve.now/CVE-2025-11369.md): Essential Blocks \<= 5.7.2 - Missing Authorization To Authenticated (Author+) Information Disclosure (CVSS 4.3) - [CVE-2025-11270](https://cve.now/CVE-2025-11270.md): Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns \<= 5.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4) - [CVE-2025-11361](https://cve.now/CVE-2025-11361.md): Essential Blocks \<= 5.7.1 - Authenticated (Author+) Server-Side Request Forgery (CVSS 6.4) - [CVE-2025-7499](https://cve.now/CVE-2025-7499.md): BetterDocs \<= 4.1.1 - Missing Authorization to Private And Password-Protected Posts Information Disclosure (CVSS 5.3) - [CVE-2025-8451](https://cve.now/CVE-2025-8451.md): Essential Addons for Elementor – Popular Elementor Templates and Widgets \<= 6.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'data-gallery-items' (CVSS 6.4) - [CVE-2025-6244](https://cve.now/CVE-2025-6244.md): Essential Addons for Elementor – Popular Elementor Templates and Widgets \<= 6.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via \`Calendar\` And \`Business Reviews\` Widgets (CVSS 6.4) - [CVE-2024-5647](https://cve.now/CVE-2024-5647.md): Multiple Plugins \<= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library (CVSS 6.4) - [CVE-2024-9993](https://cve.now/CVE-2024-9993.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 6.1.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Event Calendar Widget (CVSS 6.4) - [CVE-2024-9994](https://cve.now/CVE-2024-9994.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 6.1.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Pricing Table Widget (CVSS 6.4) - [CVE-2025-4682](https://cve.now/CVE-2025-4682.md): Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates \<= 5.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider and Post Carousel Widgets (CVSS 6.4) - [CVE-2025-1664](https://cve.now/CVE-2025-1664.md): Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates \<= 5.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4) - [CVE-2024-13803](https://cve.now/CVE-2024-13803.md): Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates \<= 5.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4) - [CVE-2024-12045](https://cve.now/CVE-2024-12045.md): Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates \<= 5.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4) - [CVE-2024-11727](https://cve.now/CVE-2024-11727.md): NotificationX – Live Sales Notification, WooCommerce Sales Popup, FOMO, Social Proof, Announcement Banner & Floating Notification Top Bar \<= 2.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4) - [CVE-2024-11203](https://cve.now/CVE-2024-11203.md): EmbedPress – Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & Elementor \<= 4.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'provider\_name' (CVSS 6.4) - [CVE-2024-8978](https://cve.now/CVE-2024-8978.md): Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders \<= 6.0.9 - Authenticated (Contributor+) Sensitive Information Exposure (CVSS 5.7) - [CVE-2024-8979](https://cve.now/CVE-2024-8979.md): Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders \<= 6.0.9 - Authenticated (Author+) Sensitive Information Exposure to Privilege Escalation (CVSS 8.0) - [CVE-2024-8961](https://cve.now/CVE-2024-8961.md): Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders \<= 6.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4) - [CVE-2021-4447](https://cve.now/CVE-2021-4447.md): Essential Addons for Elementor \<= 4.6.4 - Authenticated (Contributor+) Privilege Escalation (CVSS 8.8) - [CVE-2021-4446](https://cve.now/CVE-2021-4446.md): Essential Addons for Elementor \<= 4.6.4 - Missing Authorization (CVSS 6.3) - [CVE-2024-8742](https://cve.now/CVE-2024-8742.md): Essential Addons for Elementor \<= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery Widget (CVSS 6.4) - [CVE-2024-8440](https://cve.now/CVE-2024-8440.md): Essential Addons for Elementor -- Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget (CVSS 6.4) - [CVE-2024-7092](https://cve.now/CVE-2024-7092.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via no\_more\_items\_text Parameter (CVSS 6.4) - [CVE-2024-6557](https://cve.now/CVE-2024-6557.md): SchedulePress \<= 5.1.3 - Unauthenticated Full Path Disclosure (CVSS 5.3) - [CVE-2024-1565](https://cve.now/CVE-2024-1565.md): EmbedPress \<= 3.9.10 - Authenticated(Contributor+) Stored Cross-Site Scripting via PDF Widget URL (CVSS 6.4) - [CVE-2024-5189](https://cve.now/CVE-2024-5189.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.23 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4) - [CVE-2024-5188](https://cve.now/CVE-2024-5188.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.22 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4) - [CVE-2024-5571](https://cve.now/CVE-2024-5571.md): EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor \<= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widget (CVSS 6.4) - [CVE-2024-5073](https://cve.now/CVE-2024-5073.md): Essential Addons for Elementor \<= 5.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Feed (CVSS 6.4) - [CVE-2024-1803](https://cve.now/CVE-2024-1803.md): EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor \<= 3.9.12 - Insufficient Authorization Checks to Block Usual (CVSS 4.3) - [CVE-2024-4891](https://cve.now/CVE-2024-4891.md): Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates \<= 4.5.12 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4) - [CVE-2024-4624](https://cve.now/CVE-2024-4624.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.20 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4) - [CVE-2024-4275](https://cve.now/CVE-2024-4275.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Interactive Circles' (CVSS 6.4) - [CVE-2024-4449](https://cve.now/CVE-2024-4449.md): Essential Addons for Elementor \<= 5.9.19 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Several Widgets (CVSS 6.4) - [CVE-2024-4448](https://cve.now/CVE-2024-4448.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Dual Color Header', 'Event Calendar', & 'Advanced Data Table' (CVSS 6.4) - [CVE-2024-4316](https://cve.now/CVE-2024-4316.md): EmbedPress Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor \<= 3.9.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter (CVSS 6.4) - [CVE-2024-3728](https://cve.now/CVE-2024-3728.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery & Interactive Circle (CVSS 6.4) - [CVE-2024-4156](https://cve.now/CVE-2024-4156.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.17 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4) - [CVE-2024-4003](https://cve.now/CVE-2024-4003.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4) - [CVE-2024-3733](https://cve.now/CVE-2024-3733.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.15 - Information Exposure (CVSS 5.3) - [CVE-2024-3818](https://cve.now/CVE-2024-3818.md): Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates \<= 4.5.9 - Authenticated (Contributor+) DOM-Based Cross-Site Scripting via "Social Icons" Block (CVSS 5.4) - [CVE-2024-3333](https://cve.now/CVE-2024-3333.md): Essential Addons for Elementor \<= 5.9.14 - Authenticated (Contributor+) Store Cross-Site Scripting via Widget URL Attribute (CVSS 6.4) - [CVE-2024-2623](https://cve.now/CVE-2024-2623.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4) - [CVE-2024-2974](https://cve.now/CVE-2024-2974.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.13 - Unauthenticated Sensitive Information Exposure (CVSS 5.3) - [CVE-2024-3244](https://cve.now/CVE-2024-3244.md): EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor \<= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4) - [CVE-2024-2650](https://cve.now/CVE-2024-2650.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4) - [CVE-2024-2845](https://cve.now/CVE-2024-2845.md): BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg \<= 3.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4) - [CVE-2024-3245](https://cve.now/CVE-2024-3245.md): EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor \<= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Youtube Block (CVSS 6.4) - [CVE-2024-3018](https://cve.now/CVE-2024-3018.md): Essential Addons for Elementor \<= 5.9.13 - Authenticated (Author+) PHP Object Injection via error\_resetpassword (CVSS 8.8) - [CVE-2024-2468](https://cve.now/CVE-2024-2468.md): EmbedPress \<= 3.9.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Widget Attribute (CVSS 6.4) - [CVE-2024-2688](https://cve.now/CVE-2024-2688.md): EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor \<= 3.9.12 - Authenticated (Contributor+) Stored Cross-site Scripting via 'embedpress\_doc\_custom\_color' (CVSS 5.4) - [CVE-2024-2255](https://cve.now/CVE-2024-2255.md): Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates \<= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4) - [CVE-2024-1854](https://cve.now/CVE-2024-1854.md): Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates \<= 4.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4) - [CVE-2024-1537](https://cve.now/CVE-2024-1537.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table (CVSS 6.4) - [CVE-2024-1536](https://cve.now/CVE-2024-1536.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Event Calendar (CVSS 7.4) - [CVE-2024-1802](https://cve.now/CVE-2024-1802.md): EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor \<= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Wistia Block (CVSS 6.4) - [CVE-2024-2128](https://cve.now/CVE-2024-2128.md): EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor \<= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widget (CVSS 6.4) - [CVE-2024-1698](https://cve.now/CVE-2024-1698.md): NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor \<= 2.8.2 - Unauthenticated SQL Injection (CVSS 9.8) - [CVE-2024-1171](https://cve.now/CVE-2024-1171.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery (CVSS 5.4) - [CVE-2024-1172](https://cve.now/CVE-2024-1172.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion (CVSS 5.4) - [CVE-2024-1276](https://cve.now/CVE-2024-1276.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4) - [CVE-2024-1349](https://cve.now/CVE-2024-1349.md): EmbedPress \<= 3.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4) - [CVE-2024-1425](https://cve.now/CVE-2024-1425.md): EmbedPress \<= 3.9.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via Google Calendar Widget Link (CVSS 6.4) - [CVE-2024-1236](https://cve.now/CVE-2024-1236.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4) - [CVE-2024-0586](https://cve.now/CVE-2024-0586.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.4 - Authenticated (Contributor+) Stored Cross-Site Scritping (CVSS 6.4) - [CVE-2024-0954](https://cve.now/CVE-2024-0954.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4) - [CVE-2024-0585](https://cve.now/CVE-2024-0585.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image URl (CVSS 5.4) - [CVE-2023-7071](https://cve.now/CVE-2023-7071.md): Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates \<= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4) - [CVE-2023-7044](https://cve.now/CVE-2023-7044.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4) - [CVE-2023-6986](https://cve.now/CVE-2023-6986.md): EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor \<= 3.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4) - [CVE-2023-4386](https://cve.now/CVE-2023-4386.md): Essential Blocks \<= 4.2.0 - Unauthenticated PHP Object Injection via queries (CVSS 8.1) - [CVE-2023-4402](https://cve.now/CVE-2023-4402.md): Essential Blocks \<= 4.2.0 - Unauthenticated PHP Object Injection via products (CVSS 8.1) - [CVE-2023-4283](https://cve.now/CVE-2023-4283.md): EmbedPress \<= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4) - [CVE-2023-4282](https://cve.now/CVE-2023-4282.md): EmbedPress \<= 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Delete via admin\_post\_remove and remove\_private\_data (CVSS 5.4) - [CVE-2023-3779](https://cve.now/CVE-2023-3779.md): Essential Addons For Elementor \<=5.8.1 - Unauthenticated MailChimp API Key Disclosure (CVSS 5.3) - [CVE-2020-36744](https://cve.now/CVE-2020-36744.md): NotificationX \<= 1.8.2 - Cross-Site Request Forgery Bypass (CVSS 4.3) - [CVE-2023-3371](https://cve.now/CVE-2023-3371.md): EmbedPress \<= 3.7.3 - Sensitive Information Exposure (CVSS 5.3) - [CVE-2023-2083](https://cve.now/CVE-2023-2083.md): Essential Blocks \<= 4.0.6 - Missing Authorization via save (CVSS 4.3) - [CVE-2023-2087](https://cve.now/CVE-2023-2087.md): Essential Blocks \<= 4.0.6 - Cross-Site Request Forgery via save (CVSS 4.3) - [CVE-2023-2085](https://cve.now/CVE-2023-2085.md): Essential Blocks \<= 4.0.6 - Missing Authorization via templates (CVSS 4.3) - [CVE-2023-2086](https://cve.now/CVE-2023-2086.md): Essential Blocks \<= 4.0.6 - Missing Authorization via template\_count (CVSS 4.3) - [CVE-2023-2084](https://cve.now/CVE-2023-2084.md): Essential Blocks \<= 4.0.6 - Missing Authorization via get (CVSS 4.3) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/vendors/wpdevteam Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.