Easy Elementor Addons
Monthly
Cross-Site Request Forgery in HashThemes Easy Elementor Addons (WordPress plugin) affects all versions up to and including 2.3.7, letting a remote attacker forge state-changing requests that are executed with a victim administrator's privileges when the victim is lured into interacting with attacker-controlled content. Reported by Patchstack (CVE-2026-28164 / EUVD-2026-63327) with a vendor-assigned CVSS of 9.6; no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation hinges on tricking an authenticated user into triggering the forged request, since the plugin fails to validate request authenticity (CWE-352).
Cross-Site Request Forgery in HashThemes Easy Elementor Addons (WordPress plugin) affects all versions up to and including 2.3.7, letting a remote attacker forge state-changing requests that are executed with a victim administrator's privileges when the victim is lured into interacting with attacker-controlled content. Reported by Patchstack (CVE-2026-28164 / EUVD-2026-63327) with a vendor-assigned CVSS of 9.6; no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation hinges on tricking an authenticated user into triggering the forged request, since the plugin fails to validate request authenticity (CWE-352).