CVE-2025-69336
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Ultimate Store Kit Elementor Addons plugin (up to version 2.9.4) contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This enables unauthorized users to access functions that should be protected.
Risk Assessment
The risk is the possibility of unauthorized access to sensitive functions and data, which may lead to compromise of system integrity and confidentiality.
Recommendation
It is recommended to update the Ultimate Store Kit Elementor Addons plugin to a version newer than 2.9.4 if available, and to review and fix access control configurations.
Other vulnerabilities in Ultimate Store Kit Elementor Addons
See all- CVE-2026-65505Medium
The Ultimate Store Kit Elementor Addons plugin versions 3.0.5 and earlier are vulnerable to unauthenticated sensitive data exposure. Unauthenticated attackers can access confidential information.
- CVE-2026-65503Medium
The Ultimate Store Kit Elementor Addons plugin versions 3.0.5 and earlier have a Cross-Site Scripting (XSS) vulnerability exploitable by a contributor. A user with contributor role can inject malicious script.
- CVE-2026-25403Medium
The Ultimate Store Kit Elementor Addons plugin up to version 3.0.5 contains a Broken Access Control vulnerability that allows unauthenticated attackers to access functions without authorization.
Original NVD description (English source)
Missing Authorization vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Store Kit Elementor Addons: from n/a through <= 2.9.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS