Skip to content
OpenAdvisories

Vendor

kraftplugins

9 known vulnerabilities.

Products

Demo Importer Plus 4 Mega Elements – Addons for Elementor 2 Mega Elements 2 Wheel of Life: Coaching and Assessment Tool for Life Coach 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 6.4
    CVE-2025-8200

    Mega Elements – Addons for Elementor <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer Widget

    The Mega Elements – Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown Timer widget in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user s…

    kraftplugins Mega Elements – Addons for Elementor Web / CMS
  • Medium 6.4
    CVE-2024-9172

    Demo Importer Plus <= 2.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

    The Demo Importer Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated atta…

    kraftplugins Demo Importer Plus Web / CMS
  • Medium 6.5
    CVE-2024-37466

    WordPress Mega Elements plugin <= 1.2.2 - Contributor+ Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kraftplugins Mega Elements.This issue affects Mega Elements: from n/a through 1.2.2.

    kraftplugins Mega Elements
  • Medium 5.4
    CVE-2024-3627

    Wheel of Life: Coaching and Assessment Tool for Life Coach <= 1.1.7 - Missing Authorization on Several AJAX Endpoints

    The Wheel of Life: Coaching and Assessment Tool for Life Coach plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on several functions in the AjaxFunctions.php file in all versions up to, and inc…

    kraftplugins Wheel of Life: Coaching and Assessment Tool for Life Coach Web / CMS
  • Medium 6.4
    CVE-2024-4702

    Mega Elements <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget

    The Mega Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button widget in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes i…

    kraftplugins Mega Elements – Addons for Elementor Web / CMS
  • Medium 6.5
    CVE-2024-32575

    WordPress Mega Elements plugin <= 1.1.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kraftplugins Mega Elements allows Stored XSS.This issue affects Mega Elements: from n/a through 1.1.9.

    kraftplugins Mega Elements