Elextensions
Vulnerability activity for Elextensions: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 4
- Critical (CVSS 9+)
- 3
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 4
- Critical (CVSS 9+)
- 3
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 4
- Critical (CVSS 9+)
- 3
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 9.1CriticalNov 6, 2026Elextensions ELEX WordPress HelpDesk & Customer Ticketing System Path traversal / file handlingCVE-2026-114630The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the factory_reset function in all versions up to, and including, 3.3.8 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This vulnerability is exploitable via a two-step chain: an unauthentic
- 9.8CriticalOct 16, 2026Elextensions ELEX WordPress HelpDesk & Customer Ticketing System Path traversal / file handlingCVE-2026-103768The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
- 5.4MediumOct 15, 2026ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes Auth bypass / access controlCVE-2026-103083Authorization Bypass Through User-Controlled Key vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes: from n/a through 1.5.3.
- 9.3CriticalOct 10, 2026ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes SQL injectionCVE-2026-40800Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.5.3 versions.
Top products
- ELEX WordPress HelpDesk & Customer Ticketing System2 CVEs in the last year, 2 critical
- ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes2 CVEs in the last year, 1 critical
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.