5.3Medium

CVE-2026-2295WPZOOM Addons for Elementor – Starter Templates & Widgets <= 1.3.2 - Unauthenticated Protected Post Exposure via ajax_post_grid_load_more

wpzoom WPZOOM Addons for Elementor – Starter Templates & Widgets Published: 2026-02-11 12:27 (9 months ago)

Description

The WPZOOM Addons for Elementor – Starter Templates & Widgets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ajax_post_grid_load_more' function in all versions up to, and including, 1.3.2. This makes it possible for unauthenticated attackers to retrieve protected (draft, future, pending) post titles and excerpts that should not be accessible to unauthenticated users.

Weakness (CWE): CWE-200

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
wpzoom	WPZOOM Addons for Elementor – Starter Templates & Widgets	≤ 1.3.2

References and patches

CVSS score

5.3Medium

Source: Wordfence · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: None
Availability: None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

All scores (2)

cna	CVSS 3.1	5.3Medium
security@wordfence.com	CVSS 3.1	5.3Medium

EPSS (chance of exploitation in 30 days)

0.36%

higher than 30% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: yes
Technical impact: partial

Timeline

ID reserved2026-02-10
Published2026-02-11 12:27
Reached IP-DB2026-10-24 23:39
Last updated2026-06-17 13:30

Assigned by (CNA): Wordfence
NVD status: Deferred

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — WordPress plugins & themes

5.3Medium

CVE-2026-128834 42 minutes ago

WordPress Spectra plugin <= 2.20.5 - Broken Access Control vulnerability

Brainstorm Force Spectra

Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.20.5.

5.3Medium

CVE-2026-121771 43 minutes ago

WordPress Gutenberg Blocks plugin <= 3.7.6 - Sensitive Data Exposure vulnerability

PublishPress Gutenberg Blocks

Insertion of Sensitive Information Into Sent Data vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows Retrieve Embedded Sensitive Data.This issue affects Gutenberg Blocks: from n/a through 3.7.6.

5.3Medium

CVE-2026-125815 43 minutes ago

WordPress We’re Open! plugin <= 2.8 - Content Injection vulnerability

Noah Hearle We’re Open!

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Noah Hearle We’re Open! opening-hours allows Code Injection.This issue affects We’re Open!: from n/a through 2.8.

5.4Medium

CVE-2026-118587 3 hours ago

PowerPress Podcasting plugin by Blubrry <= 11.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' and 'height' Shortcode Attributes

blubrry PowerPress Podcasting plugin by Blubrry

The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 11.18.0 due to insufficient input sanitization and output escaping. This makes it pos…

9.8Critical

CVE-2026-119077 3 hours ago

ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.9 - Unauthenticated PHP Object Injection to Remote Code Execution via 'form' Parameter

elextensions ELEX WordPress HelpDesk & Customer Ticketing System

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.9 via the 'form (specifically the attacker-controlled ticket_label field inside the url-encoded form s…

6.4Medium

CVE-2026-126029 3 hours ago

WPZOOM Addons for Elementor <= 1.4.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regions[i][link][url]' and 'pins[i][link][url]' Parameters

wpzoom WPZOOM Addons for Elementor – Starter Templates & Widgets

The WPZOOM Addons for Elementor – Starter Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'actions[save_builder][data][elements][...][settings][regions][i][link][url] / [pins][i][link][url]' parameter in all versi…