CVE Watchtower

← Back to CVE List

CVE-2026-28192NVD

Vulnerability Summary

Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro <= 7.1.67 versions.

Severity Level

CRITICAL(9.6)

Published Date

Aug 18, 2026

Last Modified

Aug 18, 2026

Exploitation Status

No confirmed exploitation yet

EPSS Score (30-Day)

Data Pending

Root Weakness (CWE)

CWE-434: Unrestricted File Upload ↗

The software allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment.

CVSS v3.1 Base Metrics

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredNone

User InteractionRequired

ScopeChanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

External References

https://patchstack.com/database/wordpress/plugin/piotnet-addons-for-elementor-pro/vulnerability/wordpress-piotnet-addons-for-elementor-pro-plugin-7-1-67-arbitrary-file-upload-vulnerability?_s_id=cve

🚨

Receive alerts for vulnerabilities being exploited in the wild.

⚡

Get notified instantly when a Proof of Concept (PoC) exploit is published.

🔍

Access critical info on vulnerabilities even when marked as "RESERVED".

🧠

Insights powered by decades of expertise and global intelligence sources.

🎯

Customize alerts with up to 10 keywords for your specific tech stack.

📊

Export the raw CVE database for SIEM integration and reporting.

CVE-2026-64849CVSS 9.3
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior...
Admin intel📅 Updated: Aug 18, 2026
CVE-2026-71479CVSS 9.1
Multiple billing paths multiplied user-controlled quantity parameters into the quota calculation without an upper bound or overflow-safe integer...
Admin intel📅 Updated: Aug 18, 2026
CVE-2025-62593CVSS 9.4
Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool...
CISA KEV📅 Added to KEV: Aug 17, 2026
CVE-2026-59309CVSS 9.8
VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to...
Admin intel📅 Updated: Aug 15, 2026
CVE-2026-65400CVSS 9.8
An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS...
Admin intel📅 Updated: Aug 15, 2026
CVE-2026-15826CVSS 9.8
The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up...
Admin intel📅 Updated: Aug 15, 2026
CVE-2026-72898CVSS 10.0
Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator...
CISA KEV📅 Added to KEV: Aug 11, 2026
CVE-2026-20349CVSS 8.6
A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software...
CISA KEV📅 Added to KEV: Aug 11, 2026