WordPress plugin
Envo’s Templates & Widgets for Elementor and WooCommerce security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 7 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High0
- Medium7
- Low0
All Envo’s Templates & Widgets for Elementor and WooCommerce vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium4.3 | Missing Authorization to Authenticated (Author+) Private Content Disclosure via Envo Tabs Widget 'templates' Setting ≤1.4.26Update to 1.4.27 | CVE-2026-11600 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤1.4.19Update to 1.4.20 | CVE-2024-50447 | |
| Medium6.4 | Authenticated (Author+) Stored Cross-Site Scripting ≤1.4.16Update to 1.4.17 | CVE-2024-43292 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤1.4.8Update to 1.4.9 | CVE-2024-35167 | |
| Medium4.3 | Cross-Site Request Forgery via ajax_theme_activation ≤1.4.4Update to 1.4.5 | CVE-2024-0768 | |
| Medium4.3 | Missing Authorization via templates_ajax_request ≤1.4.4Update to 1.4.5 | CVE-2024-0766 | |
| Medium4.3 | Cross-Site Request Forgery via ajax_plugin_activation ≤1.4.4Update to 1.4.5 | CVE-2024-0767 |
- Medium4.3Missing Authorization to Authenticated (Author+) Private Content Disclosure via Envo Tabs Widget 'templates' Setting
≤1.4.26Update to 1.4.27
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.4.19Update to 1.4.20
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
≤1.4.16Update to 1.4.17
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.4.8Update to 1.4.9
- Medium4.3Cross-Site Request Forgery via ajax_theme_activation
≤1.4.4Update to 1.4.5
- Medium4.3Missing Authorization via templates_ajax_request
≤1.4.4Update to 1.4.5
- Medium4.3Cross-Site Request Forgery via ajax_plugin_activation
≤1.4.4Update to 1.4.5
Envo’s Templates & Widgets for Elementor and WooCommerce: common questions
Does Envo’s Templates & Widgets for Elementor and WooCommerce have known vulnerabilities?
Yes. VulnCrest Radar lists 7 known vulnerabilities in Envo’s Templates & Widgets for Elementor and WooCommerce: 7 medium. None are known to affect version null.
How do I check which version of Envo’s Templates & Widgets for Elementor and WooCommerce I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Envo’s Templates & Widgets for Elementor and WooCommerce vulnerability?
CVE-2026-11600, published Jul 1, 2026: Envo's Templates & Widgets for Elementor and WooCommerce <= 1.4.26 - Missing Authorization to Authenticated (Author+) Private Content Disclosure via Envo Tabs Widget 'templates' Setting. Severity: Medium (CVSS 4.3).
Is any Envo’s Templates & Widgets for Elementor and WooCommerce vulnerability listed in CISA KEV?
No. None of the known Envo’s Templates & Widgets for Elementor and WooCommerce vulnerabilities is currently listed in the CISA KEV catalog.