First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-59511

MediumCVSS 5.3/10Last modified Oct 25, 2026

Description

Insertion of Sensitive Information Into Sent Data vulnerability in Tim Strifler Exclusive Addons Elementor allows Retrieve Embedded Sensitive Data.

This issue affects Exclusive Addons Elementor: from n/a through 2.7.9.9.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
Tim Strifler	Exclusive Addons Elementor	<= 2.7.9.9

References

https://patchstack.com/database/wordpress/plugin/exclusive-addons-for-elementor/vulnerability/wordpress-exclusive-addons-elementor-plugin-2-7-9-9-sensitive-data-exposure-vulnerability?_s_id=cve

Timeline

Published: Jul 5, 2026
Last modified: Oct 25, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-595127.1Unauthenticated Cross Site Scripting (XSS) in Product Enquiry for WooCommerce <= 2.2.34.43 versions.CVE-2026-595136.5Subscriber Cross Site Scripting (XSS) in Masteriyo - LMS <= 2.3.0 versions.CVE-2026-595149.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyBoss Buddyboss Platform buddyboss CVE-2026-595159.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sergey AIWU ai-copilot-content-generat CVE-2026-595167.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Room 34 Creative Services, LLC ICS Cal CVE-2026-595177.1Unauthenticated Cross Site Scripting (XSS) in Easy Form Builder <= 4.0.12 versions.CVE-2026-595189.8Deserialization of Untrusted Data vulnerability in wpWax Directorist directorist allows Object Injection.This issue affects Directorist: fro CVE-2026-595195.3Insertion of Sensitive Information Into Sent Data vulnerability in Softaculous FormLayer allows Retrieve Embedded Sensitive Data. This issu CVE-2026-59524.3GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 CVE-2026-595204.3Cross-Site Request Forgery (CSRF) vulnerability in properfraction CrawlWP SEO allows Cross Site Request Forgery. This issue affects CrawlWP CVE-2026-595217.2Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC Real Testimonials testimonial-free allows Object Injection.This issue af CVE-2026-595226.5Subscriber Broken Access Control in WP ERP <= 1.17.5 versions.

CVE-2026-59511: Medium severity, CVSS 5.3 | Vulnix