CVE-2026-0673 — Element Pack Addons for Elementor <= 8.3.15 - Unauthenticated SMTP Header Injection
The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 8.3.15 via the `element_pack_contact_for…
Published: 2026-08-06 · CVSS: 5.3 · CVSS 3.1
The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 8.3.15 via the `element_pack_contact_form` AJAX action. This is due to insufficient sanitization of newline characters in user-supplied input that gets concatenated into email headers. This makes it possible for unauthenticated attackers to inject arbitrary email headers into emails sent by the contact form.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7