PT-2026-27881 · Unknown · Elementinvader Addons For Elementor

Published 2026-03-25 · Updated 2026-03-30 · CVE-2026-25007

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions ElementInvader Addons for Elementor versions n/a through 1.4.2

Description The software contains a flaw due to improper neutralization of special elements within an SQL command, leading to a potential SQL injection. Specifically, the vulnerability allows for a blind SQL injection attack. The API endpoint and vulnerable parameters are not specified. The function names are not specified. There is no information about the number of potentially affected devices or real-world exploitation incidents.

Recommendations Update ElementInvader Addons for Elementor to a version later than 1.4.2.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-25007

Affected Products

Elementinvader Addons For Elementor

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-25007 · Security Note
• https://twitter.com/CVEnew/status/2038517035727224839 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/elementinvader-addons-for-elementor/vulnerability/wordpress-elementinvader-addons-for-elementor-plugin-1-4-2-sql-injection-vulnerability?_s_id=cve · Note