# cve.now: Wpvibes

The newest entries naming Wpvibes as an affected vendor (up to 200), of 49 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-114186](https://cve.now/CVE-2026-114186.md): WordPress AnyWhere Elementor plugin \<= 1.3.0 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-114189](https://cve.now/CVE-2026-114189.md): WordPress AnyWhere Elementor plugin \<= 1.3.0 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2026-114188](https://cve.now/CVE-2026-114188.md): WordPress AnyWhere Elementor plugin \<= 1.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-103914](https://cve.now/CVE-2026-103914.md): Dynific Addons for Elementor (formerly Anywhere Elementor) \<= 1.3 - Authenticated (Subscriber+) SQL Injection via 'q' Parameter (CVSS 6.5)
- [CVE-2026-102564](https://cve.now/CVE-2026-102564.md): Dynific Addons for Elementor (formerly Anywhere Elementor) \<= 1.3.0 - Unauthenticated Arbitrary Shortcode Execution via Comment Content… (CVSS 6.5)
- [CVE-2026-119465](https://cve.now/CVE-2026-119465.md): WordPress Elementor Addon Elements plugin \<= 1.15 - Sensitive Data Exposure vulnerability (CVSS 5.3)
- [CVE-2026-119467](https://cve.now/CVE-2026-119467.md): WordPress AnyWhere Elementor plugin \<= 1.3.0 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2026-114187](https://cve.now/CVE-2026-114187.md): WordPress AnyWhere Elementor plugin \<= 1.3.0 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-114185](https://cve.now/CVE-2026-114185.md): WordPress AnyWhere Elementor plugin \<= 1.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-114183](https://cve.now/CVE-2026-114183.md): WordPress AnyWhere Elementor plugin \<= 1.3.0 - Sensitive Data Exposure vulnerability (CVSS 6.5)
- [CVE-2026-114184](https://cve.now/CVE-2026-114184.md): WordPress Elementor Addon Elements plugin \<= 1.14.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-61947](https://cve.now/CVE-2026-61947.md): WordPress Form Vibes – Database Manager for Forms plugin \<= 1.5.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-13378](https://cve.now/CVE-2026-13378.md): Form Vibes \<= 1.5.2 - Unauthenticated Stored Cross-Site Scripting via Contact Form 7 Form Field (CVSS 7.2)
- [CVE-2023-33999](https://cve.now/CVE-2023-33999.md): WordPress WP Mail Log plugin \<= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-28131](https://cve.now/CVE-2026-28131.md): WordPress Elementor Addon Elements plugin \<= 1.14.4 - Sensitive Data Exposure vulnerability (CVSS 6.5)
- [CVE-2025-13409](https://cve.now/CVE-2025-13409.md): Form Vibes – Database Manager for Forms \<= 1.4.13 - Authenticated (Admin+) SQL Injection (CVSS 4.9)
- [CVE-2025-31046](https://cve.now/CVE-2025-31046.md): WordPress AnyWhere Elementor Pro plugin \<= 2.29 - Broken Access Control Vulnerability (CVSS 4.3)
- [CVE-2025-12537](https://cve.now/CVE-2025-12537.md): Addon Elements for Elementor \<= 1.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-13215](https://cve.now/CVE-2024-13215.md): Elementor Addon Elements \<= 1.13.10 - Authenticated (Contributor+) Sensitive Information Exposure via Modal Popup (CVSS 4.3)
- [CVE-2024-10777](https://cve.now/CVE-2024-10777.md): AnyWhere Elementor \<= 1.2.11 - Authenticated (Contributor+) Post Disclosure (CVSS 4.3)
- [CVE-2024-47361](https://cve.now/CVE-2024-47361.md): WordPress Elementor Addon Elements plugin \<= 1.13.6 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2022-4974](https://cve.now/CVE-2022-4974.md): Freemius SDK \<= 2.4.2 - Missing Authorization Checks (CVSS 6.3)
- [CVE-2024-8902](https://cve.now/CVE-2024-8902.md): Elementor Addon Elements \<= 1.13.8 - Authenticated (Contributor+) Sensitive Information Exposure via table\_saved\_sections (CVSS 4.3)
- [CVE-2024-47366](https://cve.now/CVE-2024-47366.md): WordPress Elementor Addon Elements plugin \<= 1.13.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-5309](https://cve.now/CVE-2024-5309.md): Form Vibes – Database Manager for Forms \<= 1.4.12 - Missing Authorization in Multiple Functions (CVSS 5.4)
- [CVE-2024-7122](https://cve.now/CVE-2024-7122.md): Elementor Addon Elements \<= 1.13.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 6.4)
- [CVE-2024-4401](https://cve.now/CVE-2024-4401.md): Elementor Addon Elements \<= 1.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via id and eae\_slider\_animation Parameters (CVSS 6.4)
- [CVE-2024-5325](https://cve.now/CVE-2024-5325.md): Form Vibes \<= 1.4.10 - Authenticated (Subscriber+) SQL Injection via fv\_export\_data (CVSS 8.8)
- [CVE-2024-4570](https://cve.now/CVE-2024-4570.md): Elementor Addon Elements \<= 1.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-4569](https://cve.now/CVE-2024-4569.md): Elementor Addon Elements \<= 1.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-2092](https://cve.now/CVE-2024-2092.md): Elementor Addon Elements \<= 1.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Widget (CVSS 5.4)
- [CVE-2024-3743](https://cve.now/CVE-2024-3743.md): Elementor Addon Elements \<= 1.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-2792](https://cve.now/CVE-2024-2792.md): Elementor Addon Elements \<= 1.13.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'Text Separator' and 'Image Compare' Widget (CVSS 6.4)
- [CVE-2024-30422](https://cve.now/CVE-2024-30422.md): WordPress Elementor Addon Elements plugin \<= 1.13.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-2091](https://cve.now/CVE-2024-2091.md): Elementor Addon Elements \<= 1.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)
- [CVE-2024-29107](https://cve.now/CVE-2024-29107.md): WordPress Elementor Addon Elements plugin \<= 1.12.10 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-1393](https://cve.now/CVE-2024-1393.md): Elementor Addon Elements \<= 1.12.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Content Switcher Widget (CVSS 6.4)
- [CVE-2024-1391](https://cve.now/CVE-2024-1391.md): Elementor Addon Elements \<= 1.12.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Thumbnail Slider Widget (CVSS 6.4)
- [CVE-2024-1422](https://cve.now/CVE-2024-1422.md): Elementor Addon Elements \<= 1.12.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Modal Popup effet (CVSS 6.4)
- [CVE-2024-1392](https://cve.now/CVE-2024-1392.md): Elementor Addon Elements \<= 1.12.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dual Button Widget (CVSS 6.4)
- [CVE-2024-1358](https://cve.now/CVE-2024-1358.md): Elementor Addon Elements \<= 1.12.12 - Directory Traversal to Local File Inclusion (CVSS 8.8)
- [CVE-2023-51410](https://cve.now/CVE-2023-51410.md): WordPress WP Mail Log Plugin \<= 1.1.2 is vulnerable to Arbitrary File Upload (CVSS 9.9)
- [CVE-2023-47530](https://cve.now/CVE-2023-47530.md): WordPress Redirect 404 Error Page to Homepage or Custom Page with Logs Plugin \<= 1.8.7 is vulnerable to SQL Injection (CVSS 7.6)
- [CVE-2023-4690](https://cve.now/CVE-2023-4690.md): Elementor Addon Elements \<= 1.12.7 - Cross-Site Request Forgery (CVSS 5.4)
- [CVE-2023-5381](https://cve.now/CVE-2023-5381.md): Elementor Addon Elements \<= 1.12.7 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4)
- [CVE-2023-4723](https://cve.now/CVE-2023-4723.md): Elementor Addon Elements \<= 1.12.7 - Missing Authorization to Sensitive Information Exposure (CVSS 5.3)
- [CVE-2023-4689](https://cve.now/CVE-2023-4689.md): Elementor Addon Elements \<= 1.12.7 - Cross-Site Request Forgery (CVSS 5.4)
- [CVE-2023-3088](https://cve.now/CVE-2023-3088.md): WP Mail Log \<= 1.1.1 - Unauthenticated Stored Cross-Site Scripting via Email (CVSS 7.2)
- [CVE-2022-45807](https://cve.now/CVE-2022-45807.md): WordPress WP Mail Log Plugin \<= 1.0.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/wpvibes
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.