CVE-2026-1004

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The Essential Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 6.5.5 via the 'eael_product_quickview_popup' function. This makes it possible for unauthenticated attackers to retrieve WooCommerce product information for products with draft, pending, or private status, which should normally be restricted.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Jan 16, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1004046.5Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, guest users can receive new message events for publi CVE-2026-1004068.2dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. CVE-2026-1004097.5OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, re CVE-2026-100414.3The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, an CVE-2026-1004137.0SeaweedFS is a distributed storage system for files and blobs. From 4.0.388 until 4.41, the SFTP Helm chart embedded one unencrypted Ed25519 CVE-2026-1004173.1RustDesk before 1.5.0 on Windows fails to enforce the one-way file transfer option against peer clipboard file requests, allowing authentica CVE-2026-1004185.3Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire c CVE-2026-1004197.0gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to es CVE-2026-100429.8manga-image-translator contains a remote code execution vulnerability in the shared API server mode due to unsafe deserialization of untrust CVE-2026-1004206.8A sensitive information disclosure vulnerability in the cloud-client daemon of Deco BE63 allows authenticated attackers to retrieve the plai CVE-2026-100437.8MosaicML Composer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execu CVE-2026-100447.5Usagi-org ai-goofish-monitor contains an unauthenticated arbitrary file read vulnerability in the GET /api/prompts/{filename} endpoint on Wi