---
id: CVE-2026-110692
title: >-
  PowerPack Addons for Elementor 2.10.0 - 3.1.2 - Contributor+ SSRF via Charts
  Widget CSV Import
summary: >-
  The PowerPack Addons for Elementor: Widgets, Form Styler and Templates
  WordPress plugin before 3.1.3 does not validate a user-supplied URL before
  using it in a server-side HTTP request, which could allow users with the
  contributor role a…
severity: medium
cvss: 4.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N'
cvssSource: adp
cwe:
  - CWE-918
product: 'PowerPack Addons for Elementor: Widgets, Form Styler and Templates'
affected:
  - >-
    powerpack_addons_for_elementor_widgets_form_styler_and_templates >= 2.10.0 <
    3.1.3
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-04T14:06:07.486804Z'
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T14:18:22.164Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-110692'
references:
  - url: 'https://wpscan.com/vulnerability/ac6405e6-9a1e-4ad6-bfd7-e672030a31c1/'
tags:
  - cve.org
epss: 0.00218
epssPercentile: 0.12325
ingestedAt: '2026-11-05T21:36:00.372Z'
---

## Overview

The PowerPack Addons for Elementor: Widgets, Form Styler and Templates WordPress plugin before 3.1.3 does not validate a user-supplied URL before using it in a server-side HTTP request, which could allow users with the contributor role and above to perform Server-Side Request Forgery attacks against internal and loopback resources and read the response back.

## Affected

- `powerpack_addons_for_elementor_widgets_form_styler_and_templates >= 2.10.0 < 3.1.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.