Kraftplugins
9 CVEs across 7 Kraftplugins products. Browse Kraftplugins vulnerabilities, severities, and proof-of-concept exploits.
Kraftplugins products with known CVEs
Kraftplugins CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2025-14478 | High | 7.5 | 2026-01-17 | The Demo Importer Plus plugin for WordPress is vulnerable to XML External Entity Injection (XXE) in all versions up to, and including, 2.0.9 via the SVG file u… |
CVE-2025-14364 | High | 8.8 | 2025-12-18 | The Demo Importer Plus plugin for WordPress is vulnerable to unauthorized modification of data, loss of data, and privilege escalation due to a missing capabil… |
CVE-2025-13066 | High | 8.8 | 2025-12-05 | The Demo Importer Plus plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 2.0.6. This is due to insufficient fil… |
CVE-2025-8200 | Medium | 6.4 | 2025-09-26 | The Mega Elements – Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown Timer widget in all versi… |
CVE-2024-47311 | Medium | 5.3 | 2024-11-01 | Missing Authorization vulnerability in Kraft Plugins Wheel of Life wheel-of-life allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2024-49693 | Medium | 6.5 | 2024-10-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kraft Plugins Mega Elements mega-elements-addons-for-elem… |
CVE-2024-9172 | Medium | 6.4 | 2024-10-02 | The Demo Importer Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.0.1 due t… |
CVE-2024-37466 | Medium | 6.5 | 2024-07-21 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kraftplugins Mega Elements.This issue affects Mega… |
CVE-2024-3627 | Medium | 5.4 | 2024-06-20 | The Wheel of Life: Coaching and Assessment Tool for Life Coach plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missin… |
CVE-2024-4702 | Medium | 6.4 | 2024-05-15 | The Mega Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button widget in all versions up to, and including, 1.2.1… |
CVE-2024-32575 | Medium | 6.5 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kraftplugins Mega Elements allows Stored XSS.This issue a… |