CVE-2025-10873

MediumCVSS 5.3

Published: 05/11/2025(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

15th percentile - higher than 15% of all known CVEs

Summary

The ElementInvader Addons for Elementor WordPress plugin before 1.4.1 allows unauthenticated users to send arbitrary e-mails to arbitrary addresses due to missing authorization on the elementinvader_addons_for_elementor_forms_send_form action.

Risk Assessment

An attacker could abuse the site to send spam or phishing messages, damaging the organization's reputation and potentially getting the mail server blacklisted.

Recommendation

Update the ElementInvader Addons for Elementor plugin to version 1.4.1 or later.

Other vulnerabilities in ElementInvader Addons for Elementor

CVE-2026-57376High
The ElementInvader Addons for Elementor WordPress plugin contains a DOM-Based Cross-Site Scripting (XSS) vulnerability. The flaw arises from improper input neutralization during web page generation, allowing an attacker to inject malicious JavaScript code.

Original NVD description (English source)

The ElementInvader Addons for Elementor WordPress plugin before 1.4.1 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses due to missing authorization on the elementinvader_addons_for_elementor_forms_send_form action.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS