Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 14

Export CSV
CVE-2026-4885

Piotnet Addons for Elementor Pro <= 7.1.70 - Unauthenticated Arbitrary File Upload via Form File Upload

The Piotnet Addons for Elementor Pro plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the 'pafe_ajax_form_builder' function in all versions up to, and including, 7.1.70. The plugin uses an incomplete extension blacklist that only blocks php, phpt, php5, php7, and exe extensions, while allowing dangerous extensions such as .phar or .phtml to be uploaded. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The exploit can only be exploited if a file field is added to the form.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Piotnet Wordpress
Products
Piotnet Addons For Elementor Wordpress
CVE-2026-4883

Piotnet Forms <= 2.1.40 - Unauthenticated Arbitrary File Upload via Form File Upload

The Piotnet Forms plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the 'piotnetforms_ajax_form_builder' function in all versions up to, and including, 2.1.40. The plugin uses an incomplete extension blacklist that only blocks php, phpt, php5, php7, and exe extensions, while allowing dangerous extensions such as .phar or .phtml to be uploaded. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The exploit can only be exploited if a file field is added to the form.

CVSS 3.1 · 9.8 Critical EPSS 3.1% KEV · Not listed
Vendors
Piotnet Wordpress
Products
Piotnet Forms Wordpress
CVE-2024-33635

WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.17 - Unauthenticated Arbitrary Post/Page Deletion vulnerability

Missing Authorization vulnerability in Piotnet Piotnet Addons For Elementor Pro.This issue affects Piotnet Addons For Elementor Pro: from n/a through 7.1.17.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Piotnet
Products
Piotnet Addons For Elementor
CVE-2024-33634

WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.17 - Unauthenticated Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery (SSRF) vulnerability in Piotnet Piotnet Addons For Elementor Pro.This issue affects Piotnet Addons For Elementor Pro: from n/a through 7.1.17.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Piotnet
Products
Piotnet Forms
CVE-2024-33630

WordPress Piotnet Addons For Elementor plugin <= 2.4.26 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Piotnet Piotnet Addons For Elementor allows Stored XSS.This issue affects Piotnet Addons For Elementor: from n/a through 2.4.26.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Piotnet
Products
Piotnet Addons For Elementor
CVE-2024-33633

WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.17 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Piotnet Piotnet Addons For Elementor Pro allows Reflected XSS.This issue affects Piotnet Addons For Elementor Pro: from n/a through 7.1.17.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Piotnet
Products
Piotnet Forms
CVE-2024-29934

WordPress Piotnet Addons For Elementor plugin <= 2.4.25 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Piotnet Piotnet Addons For Elementor allows Stored XSS.This issue affects Piotnet Addons For Elementor: from n/a through 2.4.25.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Piotnet Wordpress
Products
Piotnet Addons For Elementor Wordpress
CVE-2023-51412

WordPress Piotnet Forms Plugin <= 1.0.25 is vulnerable to Arbitrary File Upload

Unrestricted Upload of File with Dangerous Type vulnerability in Piotnet Piotnet Forms.This issue affects Piotnet Forms: from n/a through 1.0.25.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
Piotnet
Products
Piotnet Forms
CVE-2025-57933

WordPress Piotnet Forms Plugin <= 1.0.30 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in piotnetdotcom Piotnet Forms piotnetforms allows Cross Site Request Forgery.This issue affects Piotnet Forms: from n/a through <= 1.0.30.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Piotnet Wordpress
Products
Piotnet Forms Wordpress
CVE-2025-22333

WordPress Piotnet Addons For Elementor plugin <= 2.4.31 - Cross-Site Scripting vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in piotnetdotcom Piotnet Addons For Elementor piotnet-addons-for-elementor allows Stored XSS.This issue affects Piotnet Addons For Elementor: from n/a through <= 2.4.31.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Piotnet Wordpress
Products
Piotnet Addons For Elementor Wordpress
CVE-2024-5614

Piotnet Addons For Elementor <= 2.4.29 - Unauthenticated Sensitive Information Exposure

The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.29 via the 'pafe_posts_list' function. This makes it possible for unauthenticated attackers to extract sensitive data including titles and excerpts of future, draft, and pending blog posts.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Piotnet
Products
Piotnet Addons For Elementor
CVE-2023-6220

Piotnet Forms <= 1.0.28 - Unauthenticated Arbitrary File Upload

The Piotnet Forms plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'piotnetforms_ajax_form_builder' function in versions up to, and including, 1.0.28. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS 3.1 · 8.1 High EPSS 1.4% KEV · Not listed
Vendors
Piotnet
Products
Piotnet Forms
CVE-2024-5502

Piotnet Addons For Elementor <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Accordion, Dual Heading, and Vertical Timeline widgets in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Piotnet
Products
Piotnet Addons