These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-109691 is a Cross Site Scripting (XSS) vulnerability affecting WordPress Prime Slider – Addons For Elementor plugin versions up to 4.7.1. The vulnerability allows for Stored XSS, which can be exploited by attackers to inject malicious scripts into web pages. Defenders should prioritize verifying exposure and applying patches. The CVE record and source item provide details on the vulnerability, in [truncated]
CVE-2026-108478 is a Cross-site Scripting (XSS) vulnerability affecting WordPress Element Pack Elementor Addons plugin versions up to 8.8.8. The vulnerability allows for Stored XSS and has a CVSS score of 6.5, classified as MEDIUM. The CVE record was published on 2026-10-12T17:11:55.879Z and was last modified on 2026-10-12T22:54:00.791Z. Defenders should assess exposure and prioritize verification and rem [truncated]
The CVE-2026-105886 vulnerability affects WordPress Ultimate Post Kit plugin versions up to and including 4.5.5, allowing Exploiting Incorrectly Configured Access Control Security Levels due to a Missing Authorization issue. This vulnerability has a CVSS score of 6.5 and a severity rating of MEDIUM. Defenders should verify the plugin version, review access controls, and monitor for potential exploitation [truncated]
A Cross Site Scripting (XSS) vulnerability exists in Element Pack Elementor Addons versions up to 8.8.3. This CVE was published on 2026-09-17T14:17:15.953Z and was last modified on 2026-09-19T03:17:14.793Z.
The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5. This vulnerability exists due to the plugin dynamically granting the unfiltered_upload capability to all users during form submissions and bypassing MIME type validation when allowed_file_types is not configured. Several default pre-built templates, including Job Application, Suppor [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-06T15:17:14.573Z and has not been modified since then. CVE-2026-65502 is a medium-severity unauthenticated bypass vulnerability in Element Pack Elementor Addons plugin versions <= 8.7.13. The vulnerability allows an attacker to bypass authentication and potentially lead to limited impact on integrit [truncated]
CVE-2026-25403 involves an unauthenticated broken access control vulnerability in Ultimate Store Kit Elementor Addons plugin versions 3.0.5 or earlier. This MEDIUM-severity issue, with a CVSS score of 6.5, may allow unauthorized access and potential operational impact. Users should review and apply patches or mitigations. Evidence is limited to public CVE and NVD sources. Defenders should verify exposed d [truncated]
A Server-Side Request Forgery (SSRF) vulnerability was identified in the bdthemes Instant Image Generator plugin for WordPress, affecting versions from n/a through 2.1.4. This issue allows an attacker to perform Server Side Request Forgery. The vulnerability has a CVSS score of 6.4 and a severity rating of MEDIUM. Administrators and users of the bdthemes Instant Image Generator plugin for WordPress should [truncated]
A vulnerability in Live Copy Paste for Elementor plugin versions <= 1.5.3 allows contributors to bypass access controls. This issue, known as Broken Access Control, was made public on June 26, 2026, and last modified on September 29, 2026.
CVE-2026-52705 is a critical vulnerability (CVSS Score: 9) in the SigmaForms Pro – AI Generated Forms plugin for WordPress, affecting versions up to and including 1.4.5. This vulnerability allows unauthenticated attackers to upload arbitrary files, potentially leading to remote code execution, data breaches, or other malicious activities. The vulnerability was published on June 17, 2026, and immediately g [truncated]
CVE-2026-40721 is a HIGH severity vulnerability (CVSS Score: 7.5) in Element Pack Pro plugin versions <= 9.0.6. This vulnerability allows for local file inclusion attacks, potentially enabling attackers to access sensitive files on the server. The vulnerability was published on June 17, 2026, and last modified on the same day. Users of Element Pack Pro should update to a patched version to mitigate this risk.
The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SVG Image Widget in versions up to and including 8.4.2. This is due to insufficient input sanitization and output escaping on SVG content fetched from remote URLs in the render_svg() function. Authenticated attackers with Contributor-level access and above may inject arbitrary JavaScript in SVG [truncated]
The Prime Slider – Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'follow_us_text' setting of the Mount widget in all versions up to, and including, 4.1.10. This is due to insufficient input sanitization and output escaping. Specifically, the `render_social_link()` function in `modules/mount/widgets/mount.php` outputs the `follow_us_text` Elementor widget se [truncated]
A Missing Authorization vulnerability in bdthemes Ultimate Store Kit Elementor Addons allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate Store Kit Elementor Addons: from n/a through <= 2.9.4. The vulnerability could lead to unauthorized access or disruption of service. Defenders should assess exposure and prioritize verification and potential upgrades. The [truncated]
