Advisories · Technology
wpmet ElementsKit Pro.
Every CVE that names wpmet ElementsKit Pro among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.1 Medium
ElementsKit Pro <= 4.10.1 - Unauthenticated Stored Cross-Site Scripting via 's' Parameter
- wpmet ElementsKit Pro
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
ElementsKit Pro <= 3.7.8 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via url Parameter
- wpmet ElementsKit Pro
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
ElementsKit Pro <= 3.6.6 - Authenticated (Contributor+) Sensitive Information Exposure
- wpmet ElementsKit Pro
- Information disclosure
- CVSS 6.4 Medium
ElementsKit Pro <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- wpmet ElementsKit Pro
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
ElementsKit Elementor addons and Templates Library <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Motion Text and Table Widgets
- wpmet ElementsKit Pro
- Cross-site scripting (XSS)
- CVSS 8.5 High
ElementsKit PRO <= 3.6.1 - Authenticated (Contributor+) Server-Side Request Forgery
- wpmet ElementsKit Pro
- Server-side request forgery (SSRF)
- CVSS 6.4 Medium
ElementsKit Pro <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- wpmet ElementsKit Pro
- Cross-site scripting (XSS)
- CVSS 8.8 High
ElementsKit Pro <= 3.6.0 - Authenticated (Contributor+) Local File Inclusion via Price Menu, Hotspot, and Advanced Toggle Widgets
- wpmet ElementsKit Pro
- File inclusion
- CVSS 6.4 Medium
ElementsKit Pro <= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ekit_btn_id'
- wpmet ElementsKit Pro
- Cross-site scripting (XSS)