nayon46 vulnerabilities

Products

• Awesome Wp Image Gallery 2
• Simple Wp colorfull Accordion 1
• Unlimited Addon For Elementor 1

Latest nayon46 CVEs

Newest publication first

1. CVE-2026-1904 Simple Wp colorfull Accordion <= 1.0 - Authenticated (Contributor+) Cross-Site Scripting via 'title' Shortcode Attribute

   Published 2026-02-14

   Medium·CVSS 6.4 EPSS 0.22%

   The Simple Wp colorfull Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in the 'accordion' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible...

2. CVE-2025-2540 Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via prettyPhoto JavaScript Library

   Published 2025-07-03

   Medium·CVSS 6.4 EPSS 0.34%

   Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled prettyPhoto library (version 3.1.6) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authent...

3. CVE-2025-46476 WordPress Awesome Wp Image Gallery plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability

   Published 2025-04-24

   Medium·CVSS 6.5 EPSS 0.27%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nayon46 Awesome Wp Image Gallery awesome-wp-image-gallery allows Stored XSS.This issue affects Awesome Wp Image Gallery: from n/a through <= 1.0.

4. CVE-2024-49267 WordPress Unlimited Addon For Elementor plugin <=2.0.0 - Cross Site Scripting (XSS) vulnerability

   Published 2024-10-16

   Medium·CVSS 6.5 EPSS 0.27%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nayon46 Unlimited Addon For Elementor unlimited-addon-for-elementor allows Stored XSS.This issue affects Unlimited Addon For Elementor: from n/a through <= 2.0.0.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.