Ele Blog Vulnerabilities

[en] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SolverWp Eleblog – Elementor Blog And Magazine Addons ele-blog allows PHP Local File Inclusion.This issue affects Eleblog – Elementor Blog And Magazine Addons: from n/a through <= 2.0.3.

Affected:

up to 2.0.3

Fix:

No patched version reported

Disclosed:

Feb 20, 2026

CVE-2025-69374 on NVD →

The Eleblog – Elementor Blog And Magazine Addons plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.0.3. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can...

CVSS:

8.1

Affected:

up to 2.0.3

Fix:

No patched version reported

Disclosed:

Feb 5, 2026

CVE-2025-69374 on NVD →

[en] The Eleblog – Elementor Blog And Magazine Addons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the goodbye_form_callback() function in all versions up to, and including, 1.8. This makes it possible for authenticated attackers, with Subscriber-level acc...

Affected:

up to 1.8

Fix:

No patched version reported

Disclosed:

Dec 4, 2024

CVE-2024-10663 on NVD →

The Eleblog – Elementor Blog And Magazine Addons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the goodbye_form_callback() function in all versions up to, and including, 1.8. This makes it possible for authenticated attackers, with Subscriber-level access a...

CVSS:

4.3

Affected:

up to 1.8

Fix:

No patched version reported

Disclosed:

Dec 3, 2024

CVE-2024-10663 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in solverwp.Com Eleblog – Elementor Blog And Magazine Addons allows Stored XSS.This issue affects Eleblog – Elementor Blog And Magazine Addons: from n/a through 1.8.

Affected:

up to 1.8

Fix:

No patched version reported

Disclosed:

May 3, 2024

CVE-2024-33945 on NVD →

The Eleblog – Elementor Blog And Magazine Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbi...

CVSS:

6.4

Affected:

up to 1.8

Fix:

No patched version reported

Disclosed:

Apr 30, 2024

CVE-2024-33945 on NVD →