Threat Investigation
Request a demo

CVE-2025-10873

Medium

Description

The ElementInvader Addons for Elementor WordPress plugin before 1.4.1 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses due to missing authorization on the elementinvader_addons_for_elementor_forms_send_form action.

SeverityMedium
CVSS5.3
Exploit probability—
ProductElementInvader Addons for Elementor
PublishedNov 5, 2025
First seenNov 5, 2025
Weakness typeCWE-862Missing authorization

How to fix

Update
  • ElementInvader Addons for Elementor1.4.1 or later

Affected products

ProductAffected versionsFixed in
ElementInvader Addons for Elementorv < 1.4.11.4.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.