Vulnerability · Published Nov 4, 2026 · Assigned by WPScan

CVE-2026-110692PowerPack Addons for Elementor 2.10.0 - 3.1.2 - Contributor+ SSRF via Charts Widget CSV Import

Medium 4.1

In plain English

A medium-severity server-side request forgery in PowerPack Addons for Elementor: Widgets, Form Styler and Templates from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)4.1Medium

Exploit odds (30 days)0.2%top 87.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The PowerPack Addons for Elementor: Widgets, Form Styler and Templates WordPress plugin before 3.1.3 does not validate a user-supplied URL before using it in a server-side HTTP request, which could allow users with the contributor role and above to perform Server-Side Request Forgery attacks against internal and loopback resources and read the response back.

Affected products (as reported)

Vendor	Product	Versions
Unknown	PowerPack Addons for Elementor: Widgets, Form Styler and Templates	2.10.0 – before 3.1.3

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

References

https://wpscan.com/vulnerability/ac6405e6-9a1e-4ad6-bfd7-e672030a31c1/ exploit, vdb-entry, technical-description