Log in Start free

devitemsllc

Products

ProductCVEsExploitedLatest
HT Mega Addons for Elementor – Elementor Widgets & Template Builder26–Oct 29, 2026
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin23–Sep 18, 2026
HT Event – WordPress Event Manager Plugin for Elementor1–Jan 31, 2025
Recurio – Ultimate Subscription for WooCommerce1–Jul 8, 2026
Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System1–Sep 1, 2026

Exploited and recent CVEs

  • CVE-2026-111318 Medium 5.4 HT Mega Addons for Elementor <= 3.2.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Tabs Widget href DOM Sink 0.3%
  • CVE-2026-11895 Medium 6.4 HT Mega Addons for Elementor <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table 'display_options' Setting 0.2%
  • CVE-2026-92554 Medium 6.1 ShopLentor <= 3.5.1 - Reflected Cross-Site Scripting via Query-String Parameter Name 0.4%
  • CVE-2026-19806 High 8.8 Support Genix <= 1.4.52 - Authenticated (Subscriber+) Authentication Bypass to Administrator Account Takeover via 'p' Parameter Forged Guest Token 0.7%
  • CVE-2026-6020 High 7.2 ShopLentor <= 3.3.7 - Authenticated (Administrator+) Arbitrary Function Execution via 'callback' Parameter via REST API 0.8%
  • CVE-2026-16811 Medium 4.9 ShopLentor <= 3.4.5 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter 0.4%
  • CVE-2026-16797 Medium 4.3 ShopLentor <= 3.4.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'optionSection' Parameter 0.4%
  • CVE-2026-12936 Medium 4.9 Recurio <= 1.1.3 - Authenticated (Shop Manager+) SQL Injection via 'data' Parameter 0.4%
  • CVE-2026-6287 Medium 5.4 ShopLentor - WooCommerce Builder for Elementor & Gutenberg <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Product Grid 'blockUniqId' Block Attribute 0.2%
  • CVE-2026-4059 Medium 6.4 ShopLentor <= 3.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button_text' Shortcode Attribute 0.3%
  • CVE-2026-1714 High 8.6 ShopLentor <= 3.3.2 - Unauthenticated Email Relay Abuse via 'woolentor_suggest_price_action' AJAX Action 0.7%
  • CVE-2025-13141 Medium 6.4 HT Mega – Absolute Addons For Elementor <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tag Attribute Injection 0.2%
  • CVE-2025-12493 Critical 9.8 ShopLentor <= 3.2.5 - Unauthenticated Local PHP File Inclusion via 'load_template' 0.8%
  • CVE-2025-11823 Medium 6.4 ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 0.2%
  • CVE-2025-8068 Medium 4.3 HT Mega – Absolute Addons For Elementor <= 2.9.1 - Improper Authorization to Authenticated (Contributor+) Limited Administrator Actions 0.4%
  • CVE-2025-8401 Medium 4.3 HT Mega – Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Sensitive Information Exposure 0.4%
  • CVE-2025-8151 Medium 4.3 HT Mega – Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Path Traversal to Limited Arbitrary CSS File Actions 0.5%
  • CVE-2025-3775 Medium 6.5 ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) <= 3.1.2 - Unauthenticated Server-Side Request Forgery via URL Parameter 0.3%
  • CVE-2025-1802 Medium 6.4 HT Mega – Absolute Addons For Elementor <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets 0.3%
  • CVE-2025-1527 Medium 6.4 ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) <= 3.1.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Flash Sale Countdown Module 0.3%
  • CVE-2025-1261 Medium 6.4 HT Mega – Absolute Addons For Elementor <= 2.8.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Countdown Widget 0.2%
  • CVE-2024-12599 Medium 6.4 HT Mega – Absolute Addons For Elementor <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget 0.3%
  • CVE-2024-12597 Medium 6.4 HT Mega <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via block_css and inner_css 0.3%
  • CVE-2024-13216 Medium 4.3 HT Event – WordPress Event Manager Plugin for Elementor <= 1.4.7 - Authenticated (Contributor+) Sensitive Information Exposure via HT Event: Sponsor 0.3%
  • CVE-2024-9538 Medium 4.3 ShopLentor <= 2.9.8 - Authenticated (Contributor+) Sensitive Information Exposure via WL: FAQ Widget Elementor Template 0.4%
  • CVE-2024-8910 Medium 4.3 HT Mega – Absolute Addons For Elementor <= 2.6.5 - Authenticated (Contributor+) Sensitive Information Exposure via template_id 0.3%
  • CVE-2024-8668 Medium 6.4 ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.9.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting 0.4%
  • CVE-2024-5215 Medium 6.4 HT Mega – Absolute Addons For Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets 0.4%
  • CVE-2024-5173 Medium 6.4 HT Mega – Absolute Addons For Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Player Widget Settings 0.3%
  • CVE-2024-5530 Medium 6.4 ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Product Horizontal Filter Widget 0.4%