CVE-2026-110692

PowerPack Addons for Elementor 2.10.0 - 3.1.2 - Contributor+ SSRF via Charts Widget CSV Import

State: published CNA: WPScan CVSS 3.1 4.1 Medium NVD: deferred

Description

The PowerPack Addons for Elementor: Widgets, Form Styler and Templates WordPress plugin before 3.1.3 does not validate a user-supplied URL before using it in a server-side HTTP request, which could allow users with the contributor role and above to perform Server-Side Request Forgery attacks against internal and loopback resources and read the response back.

Affected products

Vendor	Product	Versions
n/a	PowerPack Addons for Elementor: Widgets, Form Styler and Templates	2.10.0 to <3.1.3

References

External links from the record. They lead to third-party sites.

https://wpscan.com/vulnerability/ac6405e6-9a1e-4ad6-bfd7-e672030a31c1/ exploit, technical-description, vdb-entry

Dates

Reserved: 2026-10-14
Published: 2026-11-04
Updated: 2026-11-04

CVSS

4.1 Medium

Version: 3.1
Source: ADP (CISA-ADP)
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

EPSS

0.142% probability of exploitation activity in the next 30 days

Percentile: 3.563%
Score date: 2026-11-04
Model: v2026.06.15

Weakness

CWE-918 Server-Side Request Forgery (SSRF)

NVD

Status: Deferred
Published: 2026-11-04
Modified: 2026-11-04

4.1 Medium CVSS 3.1 · CISA-ADP, secondary
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

This CVE at nvd.nist.gov