Addonsorg vulnerabilities
We track 6 vulnerabilities in Addonsorg products across 5 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on November 13, 2026.
Latest Addonsorg vulnerabilities
- 8.2 High severity
Drag and Drop File Upload for Elementor Forms: Improper Limitation of a Pathname to a Restricted Directory
The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the remove_files function in all versions up to, and including, 1.6.2 This makes it possible for unauthe
- 9.8 Critical severity
PDF Invoice for WooCommerce + Drag and Drop…: Deserialization of Untrusted Data
The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.1.1 via the 'customer_note' parameter parameter. This is due to insufficient sanitization of the
- 7.2 High severity
Repeater Fields for Elementor Forms: Improper Neutralization of Input During Web Page Generation
The Repeater Fields for Elementor Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Field Value in all versions up to, and including, 2.2.7 due to insufficient input sanitization and output escaping. This makes it possible fo
- 9.8 Critical severity
Drag and Drop File Upload for Elementor Forms: Unrestricted Upload of File with Dangerous Type
The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elementor_file_upload function. This is due to insufficient file type validation in the is_file_ty
- 7.2 High severity
Repeater Fields for Gravity Forms: Improper Neutralization of Input During Web Page Generation
The Repeater Fields for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field Values in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes
- 8.1 High severity
Drag and Drop File Upload for Contact Form 7: Unrestricted Upload of File with Dangerous Type
The Drag and Drop File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file upload in versions up to, and including, 1.1.3. This is due to the plugin extracting the file extension before sanitization occurs and allowing the file type