{"affected":[{"defaultStatus":"unaffected","product":"PowerPack Addons for Elementor: Widgets, Form Styler and Templates","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"3.1.3","status":"affected","version":"2.10.0","versionType":"semver"}]}],"cveId":"CVE-2026-110692","cwes":["CWE-918"],"description":"The PowerPack Addons for Elementor: Widgets, Form Styler and Templates WordPress plugin before 3.1.3 does not validate a user-supplied URL before using it in a server-side HTTP request, which could allow users with the contributor role and above to perform Server-Side Request Forgery attacks against internal and loopback resources and read the response back.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/ac6405e6-9a1e-4ad6-bfd7-e672030a31c1/"}],"kev":null,"metrics":[],"modifiedAt":1793772025225,"publishedAt":1793772025225,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/ac6405e6-9a1e-4ad6-bfd7-e672030a31c1/"}],"remediation":[],"revision":"08b1781b08bd9d91abd69ca1b7801687918e15b73fb48782d4b6eb3d2e6ff283","sources":[{"modifiedAt":1793772025225,"name":"CNA: WPScan","retrievedAt":1793776122225,"url":"https://www.cve.org/CVERecord?id=CVE-2026-110692"}],"ssvc":null,"status":"published","title":"PowerPack Addons for Elementor 2.10.0 - 3.1.2 - Contributor+ SSRF via Charts Widget CSV Import","updatedAt":1793776122225}