https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 11:16:58 +0000 https://cve.radiocsirt.org/vuln/cve-2026-15155 <p><strong>Affected:</strong> wpdevteam Essential Addons for Elementor – Popular Elementor Templates &amp; Widgets</p> <p>The Essential Addons for Elementor – Popular Elementor Templates &amp; Widgets plugin for WordPress is vulnerable to Authenticated Account Takeover via Email Header Injection in all versions up to, and including, 6.6.10 This is due to insufficient server-side validation of a Login/Register widget setting used to construct outgoing email headers — the allowed-values restriction is enforced only in the client-side editor UI and not on the server, and the applied sanitization does not strip or encode CR/LF characters, allowing CRLF sequences stored in that setting to survive into raw mail headers. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject an additional Bcc header into the WordPress administrator&#39;s password-reset notification email, receive a copy of a valid administrator password-reset link, and achieve full administrator account takeover.</p> <p><strong>Affected:</strong> wpdevteam Essential Addons for Elementor – Popular Elementor Templates &amp; Widgets</p> <p>The Essential Addons for Elementor – Popular Elementor Templates &amp; Widgets plugin for WordPress is vulnerable to Authenticated Account Takeover via Email Header Injection in all versions up to, and including, 6.6.10 This is due to insufficient server-side validation of a Login/Register widget setting used to construct outgoing email headers — the allowed-values restriction is enforced only in the client-side editor UI and not on the server, and the applied sanitization does not strip or encode CR/LF characters, allowing CRLF sequences stored in that setting to survive into raw mail headers. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject an additional Bcc header into the WordPress administrator&#39;s password-reset notification email, receive a copy of a valid administrator password-reset link, and achieve full administrator account takeover.</p> https://cve.radiocsirt.org/vuln/cve-2026-15155