https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 20:41:13 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-332369 EUVD-2026-332369 https://cve.radiocsirt.org/vuln/euvd-2026-332369 https://cve.radiocsirt.org/vuln/fkie_cve-2026-11600 <p>The Envo&#39;s Templates &amp; Widgets for Elementor and WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization check on the Envo Tabs (and Off Canvas) widget&#39;s template rendering in versions up to, and including, 1.4.26. The render() method of the Tabs widget passes a user-controlled template/post ID directly to Elementor&#39;s get_builder_content_for_display() without verifying the referenced post&#39;s status (published/private/draft) or the visitor&#39;s authorization to view it. This makes it possible for authenticated attackers, with Author-level access and above, to disclose the contents of private Elementor-driven pages and templates to anonymous visitors by configuring an Envo Tabs widget on a public post to reference the private content&#39;s ID (which can be supplied by editing the underlying Elementor widget JSON via the Elementor editor REST API).</p> <p>The Envo&#39;s Templates &amp; Widgets for Elementor and WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization check on the Envo Tabs (and Off Canvas) widget&#39;s template rendering in versions up to, and including, 1.4.26. The render() method of the Tabs widget passes a user-controlled template/post ID directly to Elementor&#39;s get_builder_content_for_display() without verifying the referenced post&#39;s status (published/private/draft) or the visitor&#39;s authorization to view it. This makes it possible for authenticated attackers, with Author-level access and above, to disclose the contents of private Elementor-driven pages and templates to anonymous visitors by configuring an Envo Tabs widget on a public post to reference the private content&#39;s ID (which can be supplied by editing the underlying Elementor widget JSON via the Elementor editor REST API).</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-11600 https://cve.radiocsirt.org/vuln/ghsa-cc6h-g44v-7c7v <p>The Envo&#39;s Templates &amp; Widgets for Elementor and WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization check on the Envo Tabs (and Off Canvas) widget&#39;s template rendering in versions up to, and including, 1.4.26. The render() method of the Tabs widget passes a user-controlled template/post ID directly to Elementor&#39;s get_builder_content_for_display() without verifying the referenced post&#39;s status (published/private/draft) or the visitor&#39;s authorization to view it. This makes it possible for authenticated attackers, with Author-level access and above, to disclose the contents of private Elementor-driven pages and templates to anonymous visitors by configuring an Envo Tabs widget on a public post to reference the private content&#39;s ID (which can be supplied by editing the underlying Elementor widget JSON via the Elementor editor REST API).</p> <p>The Envo&#39;s Templates &amp; Widgets for Elementor and WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization check on the Envo Tabs (and Off Canvas) widget&#39;s template rendering in versions up to, and including, 1.4.26. The render() method of the Tabs widget passes a user-controlled template/post ID directly to Elementor&#39;s get_builder_content_for_display() without verifying the referenced post&#39;s status (published/private/draft) or the visitor&#39;s authorization to view it. This makes it possible for authenticated attackers, with Author-level access and above, to disclose the contents of private Elementor-driven pages and templates to anonymous visitors by configuring an Envo Tabs widget on a public post to reference the private content&#39;s ID (which can be supplied by editing the underlying Elementor widget JSON via the Elementor editor REST API).</p> https://cve.radiocsirt.org/vuln/ghsa-cc6h-g44v-7c7v