KKraftplugins

Products

Exploited and recent CVEs

• CVE-2025-14478 High 7.5 Demo Importer Plus <= 2.0.9 - Authenticated (Author+) Blind XML External Entity Injection via SVG File Upload 0.4%
• CVE-2025-14364 High 8.8 Demo Importer Plus <= 2.0.8 - Missing Authorization to Authenticated (Subscriber+) Site Reset and Privilege Escalation 0.4%
• CVE-2025-13066 High 8.8 Demo Importer Plus <= 2.0.6 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass 0.6%
• CVE-2025-8200 Medium 6.4 Mega Elements – Addons for Elementor <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer Widget 0.2%
• CVE-2024-9172 Medium 6.4 Demo Importer Plus <= 2.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload 0.3%
• CVE-2024-37466 Medium 6.5 WordPress Mega Elements plugin <= 1.2.2 - Contributor+ Cross Site Scripting (XSS) vulnerability 0.3%
• CVE-2024-3627 Medium 5.4 Wheel of Life: Coaching and Assessment Tool for Life Coach <= 1.1.7 - Missing Authorization on Several AJAX Endpoints 0.4%
• CVE-2024-4702 Medium 6.4 Mega Elements <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget 0.3%
• CVE-2024-32575 Medium 6.5 WordPress Mega Elements plugin <= 1.1.9 - Cross Site Scripting (XSS) vulnerability 0.3%