What is the CVSS score of CVE-2026-25007?

CVE-2026-25007 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Elementinvader Addons For Elementor are affected by CVE-2026-25007?

CVE-2026-25007 presents significant security risk, a SQL injection vulnerability rated CVSS 8.5.

How to fix or mitigate CVE-2026-25007?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Validate that input sanitization is in place for all user-controlled parameters.

Elementinvader Addons For Elementor CVE-2026-25007

EUVD-2026-15611 HIGH

SQL Injection (CWE-89)

2026-03-25 Patchstack

GHSA-5m42-hc66-pw45

SQLi Elementinvader Addons For Elementor Elementor

8.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15611

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.5

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows Blind SQL Injection.This issue affects ElementInvader Addons for Elementor: from n/a through <= 1.4.2.

AnalysisAI

A blind SQL injection vulnerability exists in ElementInvader Addons for Elementor, a WordPress plugin, affecting all versions through 1.4.2. An attacker can exploit this CWE-89 vulnerability to extract sensitive data from the underlying database without authentication, leveraging the plugin's improper neutralization of special SQL elements. No CVSS score, EPSS metric, or active KEV designation is currently available, but the blind SQL injection vector indicates meaningful exploitability risk requiring immediate patching.

Technical ContextAI

The vulnerability resides in the ElementInvader Addons for Elementor WordPress plugin (CPE: cpe:2.3:a:element_invader:elementinvader_addons_for_elementor:*:*:*:*:*:*:*:*), which provides custom widgets and functionality for the Elementor page builder. The root cause is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), indicating that user-supplied input is not adequately sanitized or parameterized before being incorporated into SQL queries. Blind SQL injection differs from standard SQL injection in that the attacker receives no direct database output; instead, they infer database contents through time-based or boolean-based side-channels, making exploitation slower but still achievable without authentication.

RemediationAI

Immediately update ElementInvader Addons for Elementor to a version newer than 1.4.2 when released by the vendor; monitor the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/elementinvader-addons-for-elementor/vulnerability/wordpress-elementinvader-addons-for-elementor-plugin-1-4-2-sql-injection-vulnerability?_s_id=cve for patch availability. Until a patched version is available, disable or deactivate the plugin if it is not critical to site operations. As an interim measure, restrict access to any administrative or data-input endpoints using a Web Application Firewall (WAF) with SQL injection detection rules, implement database user accounts with minimal required privileges (removing write permissions where possible), and enable query logging to detect exploitation attempts. Implement regular database backups to enable recovery if compromise is discovered.