Security Advisory

CVE-2026-0673

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-06 12:27:39

Last updated 2026-08-06 14:05:57

Assigner Wordfence

CVSS score not scored

State PUBLISHED

Description

The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 8.3.15 via the `element_pack_contact_form` AJAX action. This is due to insufficient sanitization of newline characters in user-supplied input that gets concatenated into email headers. This makes it possible for unauthenticated attackers to inject arbitrary email headers into emails sent by the contact form.

← Browse all CVEs View on cve.org ↗