EUVD-2026-76211
GHSA-9qpv-2jqp-jgpj
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
PR:H reflects the WordPress Editor role requirement; S:C and C:H capture cross-table database read; I:N consistent with read-only SQL injection.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Editor SQL Injection in Sky Addons for Elementor <= 3.8.4 versions.
AnalysisAI
SQL injection in Sky Addons for Elementor (WordPress plugin by wowdevs) versions 3.8.4 and earlier allows authenticated attackers with Editor-level WordPress privileges to query the underlying database beyond the plugin's normal scope, achieving high confidentiality impact. The scope-changed CVSS vector (S:C) indicates the injection can reach data outside the plugin's own tables - including sensitive WordPress core tables - making this an information-disclosure-focused SQLi. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress user account with at minimum the Editor role on the target WordPress installation - unauthenticated access is not possible per CVSS PR:H. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.6 score (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) accurately reflects the privilege barrier: PR:H corresponds to a WordPress Editor role, a non-trivial prerequisite that significantly limits the attacker pool to compromised or malicious editor accounts. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update Sky Addons for Elementor to the version released after 3.8.4, as detailed in the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/sky-elementor-addons/vulnerability/wordpress-sky-addons-for-elementor-plugin-3-8-4-sql-injection-vulnerability) and the plugin's WordPress.org changelog. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an audit of all WordPress user accounts with Editor privileges and above to assess exposure and identify any accounts with unusual database query activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Sky Addons For Elementor
View allThe Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Slider
The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Slider
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wowDevs Sky Addons
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wowDevs Sky Addons
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wowDevs Sky Addons
The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Slider
The Sky Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to,
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today