PT-2025-54283 · WordPress · The Ultimate Post Kit Addons For Elementor

Drtime · Published 2025-12-31 · Updated 2025-12-31 · CVE-2025-14434

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions The Ultimate Post Kit Addons for Elementor WordPress plugin versions prior to 4.0.16

Description The plugin has multiple AJAX “load more” endpoints, including upk alex grid loadmore posts, that do not properly verify post publication status before displaying content. This allows attackers without authentication to access and retrieve rendered HTML content of private and unpublished posts.

Recommendations Update to version 4.0.16 or later.

Exploit

Fix

Related Identifiers

CVE-2025-14434

Affected Products

The Ultimate Post Kit Addons For Elementor

References · 5

• 🔥 https://wpscan.com/vulnerability/bf3c3193-fc9c-454b-ad4f-94ba1669a312 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-14434 · Security Note
• https://t.me/cveNotify/147289 · Telegram Post
• https://t.me/CVEtracker/41027 · Telegram Post
• https://twitter.com/CVEnew/status/2006332207506595914 · Twitter Post