Add-ons.org vulnerabilities

We track 9 vulnerabilities in Add-ons.org products across 6 products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on October 9, 2026.

9vulnerabilities

1critical

8high

0exploited

8.5average CVSS score

Latest Add-ons.org vulnerabilities

7.5 High severity
PDF for Contact Form 7: Improper Limitation of a Pathname to a Restricted Directory
CVE-2026-94664Oct 9, 2026Add-ons.org
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in add-ons.org PDF for Contact Form 7 pdf-for-contact-form-7 allows Path Traversal.This issue affects PDF for Contact Form 7: from n/a through 7.1.0.
8.8 High severity
PDF for Elementor Forms + Drag And Drop…: Deserialization of Untrusted Data
CVE-2025-60084Dec 18, 2025Add-ons.org
Deserialization of Untrusted Data vulnerability in add-ons.org PDF for Elementor Forms + Drag And Drop Template Builder pdf-for-elementor-forms allows Object Injection.This issue affects PDF for Elementor Forms + Drag And Drop Template Builder: from n/a throug
8.8 High severity
PDF Invoice Builder for WooCommerce: Deserialization of Untrusted Data
CVE-2025-60083Dec 18, 2025Add-ons.org
Deserialization of Untrusted Data vulnerability in add-ons.org PDF Invoice Builder for WooCommerce pdf-for-woocommerce allows Object Injection.This issue affects PDF Invoice Builder for WooCommerce: from n/a through <= 6.5.0.
8.8 High severity
PDF for WPForms: Deserialization of Untrusted Data
CVE-2025-60082Dec 18, 2025Add-ons.org
Deserialization of Untrusted Data vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Object Injection.This issue affects PDF for WPForms: from n/a through <= 6.5.0.
8.8 High severity
PDF for Contact Form 7: Deserialization of Untrusted Data
CVE-2025-60081Dec 18, 2025Add-ons.org
Deserialization of Untrusted Data vulnerability in add-ons.org PDF for Contact Form 7 pdf-for-contact-form-7 allows Object Injection.This issue affects PDF for Contact Form 7: from n/a through <= 6.5.0.
7.5 High severity
PDF for Gravity Forms + Drag And Drop Template…: Deserialization of Untrusted Data
CVE-2025-60080Dec 18, 2025Add-ons.org
Deserialization of Untrusted Data vulnerability in add-ons.org PDF for Gravity Forms + Drag And Drop Template Builder pdf-for-gravity-forms allows Object Injection.This issue affects PDF for Gravity Forms + Drag And Drop Template Builder: from n/a through <= 6
10.0 Critical severity
Drag and Drop File Upload for Elementor Forms: Unrestricted Upload of File with Dangerous Type
CVE-2025-49387Aug 28, 2025Add-ons.orgEPSS 1.48%
Unrestricted Upload of File with Dangerous Type vulnerability in add-ons.org Drag and Drop File Upload for Elementor Forms drag-and-drop-file-upload-for-elementor-forms allows Upload a Web Shell to a Web Server.This issue affects Drag and Drop File Upload for
8.6 High severity
Drag and Drop File Upload for Elementor Forms: Improper Limitation of a Pathname to a Restricted Directory
CVE-2025-47492May 23, 2025Add-ons.orgEPSS 1.48%
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in add-ons.org Drag and Drop File Upload for Elementor Forms drag-and-drop-file-upload-for-elementor-forms allows Path Traversal.This issue affects Drag and Drop File
7.6 High severity
PDF Invoice Builder for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command
CVE-2025-47537May 7, 2025Add-ons.org
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in add-ons.org PDF Invoice Builder for WooCommerce pdf-for-woocommerce allows SQL Injection.This issue affects PDF Invoice Builder for WooCommerce: from n/a thro