CVE-2026-28164

CRITICAL9.6

Published 2026-08-20 · Updated 2026-08-20 · Source audit@patchstack.com

Description

Cross-Site Request Forgery (CSRF) vulnerability in HashThemes Easy Elementor Addons allows Cross Site Request Forgery. This issue affects Easy Elementor Addons: from n/a through 2.3.7.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CWE-352

References

https://patchstack.com/database/wordpress/plugin/easy-elementor-addons/vulnerability/wordpress-easy-elementor-addons-plugin-2-3-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-16926
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to overwrite arbitrary files due to improper neutralization of special elements in input.
2026-08-20 · score 9.1
CVE-2026-15706
Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application (BMS) allows Authentication Bypass. This issue affects Baylan Smart Meter Management Application (BMS): before v1.1.10.142.
2026-08-20 · score 9.8
CVE-2026-74018
Subscriber Arbitrary File Upload in Warehouse Cargo <= 2.6.9 versions.
2026-08-20 · score 9.9
CVE-2026-74016
Subscriber Arbitrary File Upload in Smart Cleaning <= 4.8.6 versions.
2026-08-20 · score 9.9
CVE-2026-74014
Subscriber Arbitrary File Upload in IT Residence <= 3.2.1 versions.
2026-08-20 · score 9.9