Skip to content
Sign in
6.5 Medium

CVE-2026-1793 The Element Pack Addons for Elementor plugin for WordPress is vulnerable to arbitrary file reads in all versions up…

Description

The Element Pack Addons for Elementor plugin for WordPress is vulnerable to arbitrary file reads in all versions up to, and including, 8.3.17 via the SVG widget and a lack of sufficient file validation in the 'render_svg' function. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

Affected products and versions

Product Affected versions Fixed in
Element Pack Addons for Elementor 8.3 earliest → 8.3.17 No fix stated
Element Pack – Widgets, Templates & Addons for Elementor 8.3 earliest → 8.3.17 No fix stated

Other CVEs of Element Pack Addons for Elementor

The 3 CVEs of Element Pack Addons for Elementor →
CVE-2025-13196 The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Open… 5.4 Medium CVE-2025-11536 The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all… 5.0 Medium
Track this CVE