bdthemes Vulnerabilities and Affected Products
Vulnerabilities associated with Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons.
Products
Clear product- Element Pack – Widgets, Templates & Addons for Elementor29 vulnerabilities
- Prime Slider – Addons for Elementor17 vulnerabilities
- Ultimate Store Kit Elementor Addons12 vulnerabilities
- Element Pack Elementor Addons9 vulnerabilities
- Element Pack Pro4 vulnerabilities
- prime_slider4 vulnerabilities
- ZoloBlocks4 vulnerabilities
- Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor3 vulnerabilities
- Instant Image Generator2 vulnerabilities
- Ultimate Post Kit Addons for Elementor2 vulnerabilities
- utlimate_store_kit_elementor_addons2 vulnerabilities
- ZoloBlocks – Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates & Patterns2 vulnerabilities
- Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons1 vulnerability
- Element Pack Elementor Addons and Templates1 vulnerability
- Element Pack Pro - Addon for Elementor Page Builder WordPress Plugin1 vulnerability
- element_pack_elementor_addons1 vulnerability
- instant_image_generator1 vulnerability
- Live Copy Paste for Elementor1 vulnerability
- Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery1 vulnerability
- SigmaForms Pro – AI Generated Forms1 vulnerability
- Spin Wheel – Interactive spinning wheel that offers coupons1 vulnerability
- Ultimate Post Kit1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-0673MEDIUM | Element Pack Addons for Elementor <= 8.3.15 - Unauthenticated SMTP Header InjectionThe Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 8.3.15 via the `element_pack_contact_form` AJAX action. This is due to insufficient sanitization of newline characters in user-supplied input that gets concatenated into email headers. This makes it possible for unauthenticated attackers to inject arbitrary email headers into emails sent by the contact form. CWE-93Aug 6, 2026 | CVSS5.3v3.1 | EPSS0.21% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |