Elementor — PoC Archivehttps://poc.intelseclab.com/tags/elementor/Latest proof-of-concept entries.Hugoen-usSun, 05 Jul 2026 00:00:00 +0000WordPress HT Mega (Absolute Addons for Elementor) Unauthenticated PII Disclosure (CVE-2026-4106)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4106-htmega-wordpress-pii-disclosure/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4106-htmega-wordpress-pii-disclosure/High severity — web · CVE-2026-4106. Status: Weaponized. Affects: HT Mega – Absolute Addons for Elementor (WordPress plugin). Tags: wordpress, elementor, ht-mega, wp-ajax, pii-disclosure, missing-authorization, mass-scanner, plugin-vulnerability.webHighwordpresselementorht-megawp-ajaxpii-disclosuremissing-authorizationmass-scannerplugin-vulnerabilityPiotnet Addons for Elementor Pro Unauthenticated Arbitrary File Upload RCE (CVE-2026-4885)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4885-piotnet-elementor-file-upload/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4885-piotnet-elementor-file-upload/Critical severity — web · CVE-2026-4885. Status: PoC. Affects: Piotnet Addons for Elementor Pro (WordPress plugin). Tags: wordpress, wordpress-plugin, elementor, piotnet, file-upload, webshell, unauthenticated, rce, mass-exploit.webCriticalwordpresswordpress-pluginelementorpiotnetfile-uploadwebshellunauthenticatedrcemass-exploitLA-Studio Element Kit for Elementor — Unauthenticated Admin Account Creation (CVE-2026-0920)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0920-lakit-elementor-privesc/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0920-lakit-elementor-privesc/Critical severity (CVSS 9.8) — web · CVE-2026-0920. Status: Weaponized. Affects: LA-Studio Element Kit for Elementor (WordPress plugin, slug lakit). Tags: wordpress, plugin, elementor, privilege-escalation, admin-takeover, unauthenticated, ajax, wp-ajax.webCriticalwordpresspluginelementorprivilege-escalationadmin-takeoverunauthenticatedajaxwp-ajaxIntegration for ActiveCampaign Unauthenticated PHP Object Injection via Unsafe Deserialization (CVE-2026-9691)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-9691-activecampaign-cf7-php-object-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-9691-activecampaign-cf7-php-object-injection/High severity (CVSS 8.1) — web · CVE-2026-9691. Status: PoC. Affects: "Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms" WordPress plugin. Tags: wordpress, contact-form-7, wpforms, elementor, ninja-forms, php-object-injection, deserialization, cwe-502, unauthenticated.webHighwordpresscontact-form-7wpformselementorninja-formsphp-object-injectiondeserializationcwe-502unauthenticatedElementsKit Elementor Addons Authenticated Stored XSS via REST API (CVE-2026-2600)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-2600-elementskit-stored-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-2600-elementskit-stored-xss/Medium severity (CVSS 6.4) — web · CVE-2026-2600. Status: Weaponized. Affects: ElementsKit Elementor Addons (WordPress plugin). Tags: wordpress, elementor, stored-xss, rest-api, privilege-escalation, contributor, plugin, cwe-79.webMediumwordpresselementorstored-xssrest-apiprivilege-escalationcontributorplugincwe-79Easy Elements for Elementor Unauthenticated Privilege Escalation via `custom_meta` Overwrite (CVE-2026-9018)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-9018-easy-elements-elementor-privesc/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-9018-easy-elements-elementor-privesc/High severity (CVSS 8.8) — web · CVE-2026-9018. Status: PoC. Affects: Easy Elements for Elementor – Addons & Website Templates (easy-elements WordPress plugin). Tags: wordpress, elementor, easy-elements, privilege-escalation, cwe-269, unauthenticated, ajax, wp-capabilities.webHighwordpresselementoreasy-elementsprivilege-escalationcwe-269unauthenticatedajaxwp-capabilities