CVE-2026-28164

CriticalCVSS 9.6

Published: 20/08/2026(UTC)Updated: 18/10/2026(UTC)Translated: 20/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

Cross-Site Request Forgery (CSRF) vulnerability in HashThemes Easy Elementor Addons. Allows an attacker to perform unauthorized actions on behalf of a logged-in user. Affects versions up to 2.3.7.

Risk Assessment

The risk involves the possibility of performing unwanted operations in the admin panel by the victim, which may lead to configuration changes or data integrity compromise.

Recommendation

Immediately update the Easy Elementor Addons plugin to the latest available version that fixes this vulnerability.

Other vulnerabilities in Easy Elementor Addons

CVE-2025-9045Medium
The Easy Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widget parameters in versions up to and including 2.2.9 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts that execute whenever a user accesses an injected page.

Original NVD description (English source)

Cross-Site Request Forgery (CSRF) vulnerability in HashThemes Easy Elementor Addons allows Cross Site Request Forgery. This issue affects Easy Elementor Addons: from n/a through 2.3.7.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS