Kraftplugins vulnerabilities

Products

• Demo Importer Plus 4
• Mega Elements 4
• Mega Elements 4
• Mega Elements – Addons For Elementor 2
• Wheel Of Life 2

Newest

• kraft plugins demo importer plus Demo Importer Plus <= 2.0.9 - Authenticated (Author+) Blind XML External Entity Injection via SVG File Upload CVE-2025-14478 7.5 HighJanuary 17, 2026
• kraft plugins demo importer plus Demo Importer Plus <= 2.0.8 - Missing Authorization to Authenticated (Subscriber+) Site Reset and Privilege Escalation CVE-2025-14364 Public exploit 8.8 HighDecember 18, 2025
• kraft plugins demo importer plus Demo Importer Plus <= 2.0.6 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass CVE-2025-13066 8.8 HighDecember 5, 2025
• kraftplugins mega elements – addons for elementor Mega Elements – Addons for Elementor <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer Widget CVE-2025-8200 6.4 MediumSeptember 26, 2025
• kraft plugins wheel of life WordPress Wheel of Life plugin <= 1.1.8 - Broken Access Control vulnerability CVE-2024-47311 5.3 MediumNovember 1, 2024
• kraft plugins mega elements WordPress Mega Elements – Addons for Elementor plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability CVE-2024-49693 6.5 MediumOctober 24, 2024
• kraft plugins mega elements WordPress Mega Elements – Addons for Elementor plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability CVE-2024-47343 6.5 MediumOctober 6, 2024
• kraft plugins demo importer plus Demo Importer Plus <= 2.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload CVE-2024-9172 6.4 MediumOctober 2, 2024
• kraftplugins mega elements WordPress Mega Elements plugin <= 1.2.2 - Contributor+ Cross Site Scripting (XSS) vulnerability CVE-2024-37466 6.5 MediumJuly 21, 2024
• kraftplugins wheel of life: coaching and assessment tool for life coach, wheel of life +1 more Wheel of Life: Coaching and Assessment Tool for Life Coach <= 1.1.7 - Missing Authorization on Several AJAX Endpoints CVE-2024-3627 5.4 MediumJune 20, 2024
• kraftplugins mega elements, mega elements – addons for elementor +1 more Mega Elements <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget CVE-2024-4702 6.4 MediumMay 15, 2024
• kraftplugins mega elements WordPress Mega Elements plugin <= 1.1.9 - Cross Site Scripting (XSS) vulnerability CVE-2024-32575 6.5 MediumApril 18, 2024