Vulnerabilities / AnyWhere Elementor
AnyWhere Elementor vulnerabilities
Advisories WPSec published for Dynific Addons for Elementor (formerly Anywhere Elementor). Other sources may list more. Its attack surface: AnyWhere Elementor on WPSec AttackSurface.
| Published | ID | Vulnerability | Severity | Fixed in |
|---|---|---|---|---|
| 2026-11-03 | WPSEC-2026-2201 | AnyWhere Elementor <= 1.3.0 - Authenticated (Contributor+) Information Exposure via dynific_template Shortcode | Medium 4.3 | 1.3.1 |
| 2026-11-03 | WPSEC-2026-2200 | AnyWhere Elementor <= 1.3.0 - Authenticated (Subscriber+) SQL Injection via 'q' Parameter | Medium 6.5 | 1.3.1 |
| 2026-11-03 | WPSEC-2026-2199 | AnyWhere Elementor <= 1.3.0 - Unauthenticated Sensitive Information Exposure via AJAX Lookup and Pagination Handlers | Medium 5.3 | 1.3.1 |
| 2026-11-03 | WPSEC-2026-2198 | AnyWhere Elementor <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Settings | Medium 6.4 | 1.3.1 |
| 2026-11-03 | WPSEC-2026-2197 | AnyWhere Elementor <= 1.3.0 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update | Medium 4.3 | 1.3.1 |
| 2026-11-03 | WPSEC-2026-2196 | AnyWhere Elementor <= 1.3.0 - Unauthenticated Arbitrary Shortcode Execution via Comments | High 7.3 | 1.3.1 |
License: CC BY 4.0