Piotnet Addons For Elementor Pro Vulnerabilities

The Piotnet Addons For Elementor Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 7.1.67. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code exec...

CVSS:

9.8

Affected:

up to 7.1.67

Fix:

No patched version reported

Disclosed:

Aug 13, 2026

CVE-2026-28192 on NVD →

The Piotnet Addons for Elementor Pro plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the 'pafe_ajax_form_builder' function in all versions up to, and including, 7.1.70. The plugin uses an incomplete extension blacklist that only blocks php, phpt, php5, php7, and exe ex...

CVSS:

9.8

Affected:

up to 7.1.70

Fix:

No patched version reported

Disclosed:

May 18, 2026

CVE-2026-4885 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Piotnet Piotnet Addons For Elementor Pro allows Stored XSS.This issue affects Piotnet Addons For Elementor Pro: from n/a through 7.1.17.

Affected:

up to 7.1.17

Fix:

No patched version reported

Disclosed:

Apr 29, 2024

CVE-2024-33631 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Piotnet Piotnet Addons For Elementor Pro.This issue affects Piotnet Addons For Elementor Pro: from n/a through 7.1.17.

Affected:

up to 7.1.17

Fix:

No patched version reported

Disclosed:

Apr 29, 2024

CVE-2024-33632 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Piotnet Piotnet Addons For Elementor Pro allows Reflected XSS.This issue affects Piotnet Addons For Elementor Pro: from n/a through 7.1.17.

Affected:

up to 7.1.17

Fix:

No patched version reported

Disclosed:

Apr 29, 2024

CVE-2024-33633 on NVD →

[en] Server-Side Request Forgery (SSRF) vulnerability in Piotnet Piotnet Addons For Elementor Pro.This issue affects Piotnet Addons For Elementor Pro: from n/a through 7.1.17.

Affected:

up to 7.1.17

Fix:

No patched version reported

Disclosed:

Apr 29, 2024

CVE-2024-33634 on NVD →

[en] Missing Authorization vulnerability in Piotnet Piotnet Addons For Elementor Pro.This issue affects Piotnet Addons For Elementor Pro: from n/a through 7.1.17.

Affected:

up to 7.1.17

Fix:

No patched version reported

Disclosed:

Apr 29, 2024

CVE-2024-33635 on NVD →

The Piotnet Addons For Elementor Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.1.17. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application which can be used to query and modify...

CVSS:

7.2

Affected:

up to 7.1.17

Fix:

No patched version reported

Disclosed:

Apr 25, 2024

CVE-2024-33634 on NVD →

The Piotnet Addons For Elementor Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 7.1.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web...

CVSS:

6.4

Affected:

up to 7.1.17

Fix:

No patched version reported

Disclosed:

Apr 25, 2024

CVE-2024-33631 on NVD →

The Piotnet Addons For Elementor Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 7.1.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if the...

CVSS:

6.1

Affected:

up to 7.1.17

Fix:

No patched version reported

Disclosed:

Apr 25, 2024

CVE-2024-33633 on NVD →

The Piotnet Addons For Elementor Pro plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on a function in all versions up to, and including, 7.1.17. This makes it possible for unauthenticated attackers to delete arbitrary pages and posts.

CVSS:

5.3

Affected:

up to 7.1.17

Fix:

No patched version reported

Disclosed:

Apr 25, 2024

CVE-2024-33635 on NVD →

The Piotnet Addons For Elementor Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 7.1.17. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request...

CVSS:

4.3

Affected:

up to 7.1.17

Fix:

No patched version reported

Disclosed:

Apr 25, 2024

CVE-2024-33632 on NVD →