Vertex Addons for Elementor <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation via 'afeb_activate_required_plugins'
high
The Vertex Addons for Elementor plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.6.4. This is due to improper authorization enforcement in the activate_required_plugins() function. Specifically, the current_user_can('install_plugins') capability check does not terminate...
- CVSS:
- 8.8
- Affected:
- up to 1.6.4
- Fixed in:
- 1.7.0
- Disclosed:
- Apr 8, 2026
CVE-2026-4326 on NVD →
Vertex Addons for Elementor <= 1.6.4 - Missing Authorization
medium
The Vertex Addons for Elementor plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.
- CVSS:
- 4.3
- Affected:
- up to 1.6.4
- Fixed in:
- 1.7.0
- Disclosed:
- Mar 23, 2026
CVE-2026-25398 on NVD →
Vertex Addons for Elementor <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
medium
The Vertex Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scrip...
- CVSS:
- 6.4
- Affected:
- up to 1.2.0
- Fixed in:
- 1.3.0
- Disclosed:
- Feb 14, 2025
CVE-2025-26769 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database