Skip to content
Threat Feed
Subscribe

Vendor

Essential Addons for Elementor

1 brief RSS
high advisory

Authenticated Account Takeover in Essential Addons for Elementor WordPress Plugin

A vulnerability (CVE-2026-15155) in the Essential Addons for Elementor WordPress plugin, specifically within its Login/Register widget, allows authenticated attackers with Contributor-level access or higher to achieve administrator account takeover by injecting an additional Bcc header into administrator password-reset notification emails.

Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin wordpress plugin web-application cve account-takeover email-injection
3t 1c