CVE-2025-10873: Unknown Elementinvader Addons For Elementor

Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The ElementInvader Addons for Elementor WordPress plugin before 1.4.1 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses due to missing authorization on the elementinvader_addons_for_elementor_forms_send_form action.

Affected products

• Unknown Elementinvader Addons For Elementor: before 1.4.1 (fixed in 1.4.1)

Published 2025-11-05. Last modified 2026-06-17.