techeshta vulnerabilities

Products

• Card Elements for Elementor 2
• Card Elements for WPBakery 1
• Layouts for Elementor 1
• Layouts for WPBakery 1
• Post Layouts for Gutenberg 1
• Timeline Blocks for Gutenberg 1

Latest techeshta CVEs

Newest publication first

1. CVE-2026-7726 Layouts for WPBakery <= 1.1.3 - Missing Authorization to Unauthenticated Template Cache Manipulation via 'handle_sync' AJAX Action

   Published 2026-08-05

   Medium·CVSS 6.5 EPSS 0.47%

   The Layouts for WPBakery plugin for WordPress is vulnerable to unauthorized actions due to a missing capability check on the Layouts_WPB_Remote::template_sync() callback registered via wp_ajax_nopriv_handle_sync in all versions up to, and including, 1.1.3. This makes it possible...

2. CVE-2026-6551 Timeline Blocks for Gutenberg <= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' Block Attribute

   Published 2026-04-28

   Medium·CVSS 6.4 EPSS 0.19%

   The Timeline Blocks for Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'titleTag' attribute of the timeline-blocks/tb-timeline-blocks block in all versions up to, and including, 1.1.10 due to insufficient input sanitization and output escaping...

3. CVE-2025-58220 WordPress Card Elements for WPBakery Plugin <= 1.0.8 - Cross Site Scripting (XSS) Vulnerability

   Published 2025-09-22

   Medium·CVSS 6.5 EPSS 0.21%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Techeshta Card Elements for WPBakery card-elements-for-wpbakery allows DOM-Based XSS.This issue affects Card Elements for WPBakery: from n/a through <= 1.0.8.

4. CVE-2024-13734 Card Elements for Elementor <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Profile Card Widget

   Published 2025-02-27

   Medium·CVSS 5.4 EPSS 0.29%

   The Card Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Profile Card widget in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

5. CVE-2024-43123 WordPress Card Elements for Elementor plugin <= 1.2.2 - Cross Site Scripting (XSS) vulnerability

   Published 2024-08-12

   Medium·CVSS 6.5 EPSS 0.26%

   Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Techeshta Card Elements for Elementor allows Stored XSS.This issue affects Card Elements for Elementor: from n/a through 1.2.2.

6. CVE-2024-38682 WordPress Post Layouts for Gutenberg plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability

   Published 2024-07-20

   Medium·CVSS 6.5 EPSS 0.32%

   Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Techeshta Post Layouts for Gutenberg allows Stored XSS.This issue affects Post Layouts for Gutenberg: from n/a through 1.2.7.

7. CVE-2024-30533 WordPress Layouts for Elementor plugin < 1.8 - Arbitrary File Upload vulnerability

   Published 2024-03-31

   High·CVSS 7.5 EPSS 0.46%

   Unrestricted Upload of File with Dangerous Type vulnerability in Techeshta Layouts for Elementor.This issue affects Layouts for Elementor: from n/a before 1.8.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.