Webangon maintains a narrowly scoped portfolio of WordPress plugin products, including The Pack Elementor Addons and News Element, that extend page-building and content-management functionality for website developers. Its vulnerabilities skew toward serious outcomes and recur through web application input-handling and access-control weakness classes—cross-site scripting, path traversal, cross-site request forgery, and related pathname-validation flaws—that are characteristic of plugins operating in the WordPress application layer. Defenders should monitor this vendor's plugin releases and keep WordPress installations current; live severity and exploitation counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Webangon over time
Signals from CVEs in this vendor scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-6459CRITICAL The News Element Elementor Blog Magazine WordPress plugin before 1.0.6 is vulnerable to Local File Inclusion via the template parameter. This makes it possible for unauthenticated | Aug 17, 2024 | 9.8 | 26 | NO | NO |
CVE-2024-50453HIGH Relative Path Traversal vulnerability in webangon The Pack Elementor addons the-pack-addon allows PHP Local File Inclusion.This issue affects The Pack Elementor addons: from n/a th | Oct 28, 2024 | 8.8 | 24 | NO | NO |
CVE-2024-38768HIGH Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Webangon The Pack Elementor addons allows PHP Local File Inclusion, Path Traversal.T | Aug 1, 2024 | 8.8 | 24 | NO | NO |
CVE-2025-30845HIGH Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in webangon The Pack Elementor addons the-pack-addon allows PH | Mar 27, 2025 | 7.5 | 21 | NO | NO |
CVE-2025-46472MEDIUM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webangon The Pack Elementor addons the-pack-addon allows Stored XSS.This issue | Apr 24, 2025 | 6.5 | 18 | NO | NO |
CVE-2025-30925MEDIUM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webangon The Pack Elementor addons the-pack-addon allows Stored XSS.This issue | Mar 27, 2025 | 6.5 | 18 | NO | NO |
CVE-2024-32785MEDIUM Cross-Site Request Forgery (CSRF) vulnerability in Webangon The Pack Elementor addons allows Cross-Site Scripting (XSS).This issue affects The Pack Elementor addons: from n/a throu | Apr 24, 2024 | 6.1 | 18 | NO | NO |
CVE-2025-6550MEDIUM The The Pack Elementor addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slider_options’ parameter in all versions up to, and including, 2.1.4 due to | Jun 27, 2025 | 5.4 | 17 | NO | NO |
CVE-2024-52356MEDIUM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webangon The Pack Elementor addons the-pack-addon allows Stored XSS.This issue | Nov 11, 2024 | 5.4 | 17 | NO | NO |
CVE-2024-47383MEDIUM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webangon The Pack Elementor addons the-pack-addon allows Stored XSS.This issue | Oct 5, 2024 | 4.8 | 17 | NO | NO |
Signals from CVEs in this vendor scope (11 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Webangon.
Media articles that mention a CVE ID that affects a product developed by Webangon — matched by CVE ID, not by vendor name.