Threat database

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Slider – Addons For Elementor bdthemes-prime-slider-lite allows Stored XSS.This issue affects Prime Slider – Addons For Elementor: from n/a through 4.7.1.

CVE-2026-108478 is a stored cross-site scripting (XSS) vulnerability in BdThemes Element Pack Elementor Addons. It affects versions from the initial release up to 8.8.8. The vulnerability arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts that can be stored and executed in users' browsers. The CVSS 3.1 score is 6.5, indicating a medium severity with network attack vector, low attack complexity, requiring privileges and user interaction, and impacts confidentiality, integrity, and availability.

Missing Authorization vulnerability in BdThemes Ultimate Post Kit ultimate-post-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Post Kit: from n/a through 4.5.5.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Slider – Addons For Elementor bdthemes-prime-slider-lite allows Stored XSS.This issue affects Prime Slider – Addons For Elementor: from n/a through 4.6.2.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.6.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.6.

Contributor SQL Injection in Live Copy Paste for Elementor <= 1.5.10 versions.

The Biggop Library is vulnerable to Cross-Site Scripting via the ‘display_id’ parameter from the Sigmative API in various versions due to insufficient output escaping. This makes it possible for attackers who can compromise the Sigmative API server to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Contributor Cross Site Scripting (XSS) in Element Pack Elementor Addons <= 8.8.3 versions.

The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_submission_files function in all versions up to, and including, 1.4.11. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The malicious path traversal URL is submitted via form upload field and stored in the database, with deletion triggered when an administrator deletes the submission record from the admin panel.

Sigma Forms Pro plugin for WordPress up to version 1.4.5 contains a critical vulnerability allowing unauthenticated remote code execution via unrestricted file uploads. The plugin grants unfiltered upload capability during form submissions and bypasses MIME type validation if allowed_file_types is not configured. Several default templates include file upload fields without file type restrictions, making exploitation possible immediately after installation.

CVE-2026-65502 is an authentication bypass vulnerability affecting Element Pack Elementor Addons versions up to and including 8.7.13. This flaw allows unauthenticated attackers to bypass authentication controls by spoofing, potentially leading to unauthorized actions. The vulnerability has a medium severity with a CVSS score of 5.3. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

CVE-2026-25403 is a medium severity vulnerability in Ultimate Store Kit Elementor Addons versions up to and including 3.0.5. It involves unauthenticated broken access control (CWE-862), allowing unauthorized users to access functionality or data without proper authorization.

The Element Pack Addons for Elementor WordPress plugin is vulnerable to email header injection via the element_pack_contact_form AJAX action in all versions up to and including 8.3.15. This vulnerability arises from insufficient sanitization of newline characters in user input that is concatenated into email headers, allowing unauthenticated attackers to inject arbitrary email headers. The CVSS 3.1 base score is 5.3, indicating a medium severity vulnerability.

Unauthenticated Sensitive Data Exposure in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.

Contributor Cross Site Scripting (XSS) in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.

Server-Side Request Forgery (SSRF) vulnerability in bdthemes Instant Image Generator ai-image allows Server Side Request Forgery.This issue affects Instant Image Generator: from n/a through <= 2.1.4.

Contributor Broken Access Control in Live Copy Paste for Elementor <= 1.5.3 versions.

CVE-2026-52705 is a critical vulnerability in BDthemes SigmaForms Pro – AI Generated Forms versions up to and including 1.4.5. It allows unauthenticated attackers to upload arbitrary files of dangerous types, leading to potential full compromise of confidentiality, integrity, and availability. The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). No official patch or remediation guidance is currently available from the vendor.