Responsive Plus – Elementor Templates & Starter Sites < 3.4.3 - Unauthenticated Arbitrary Code Execution

Wordfence Intelligence   >   Vulnerability Database   >   Responsive Plus – Elementor Templates & Starter Sites < 3.4.3 - Unauthenticated Arbitrary Code Execution
9.8
Improper Control of Generation of Code ('Code Injection')
CVE CVE-2025-15488
CVSS 9.8 (Critical)
Publicly Published March 30, 2026
Last Updated April 9, 2026
Researcher Alex Tselevich (nos3curity)

Description

The Responsive Plus – Elementor Templates & Starter Sites plugin for WordPress is vulnerable to Remote Code Execution in all versions up to 3.4.3 (exclusive). This makes it possible for unauthenticated attackers to execute code on the server.

References

Share

Vulnerability Details for Responsive Starter Templates – Elementor Templates & Starter Sites

Responsive Starter Templates – Elementor Templates & Starter Sites

Software Type Plugin
Software Slug responsive-add-ons (view on wordpress.org)
Patched? Yes
Remediation Update to version 3.4.3, or a newer patched version
Affected Version
  • < 3.4.3
Patched Version
  • 3.4.3

Recent vulnerabilities in Responsive Starter Templates – Elementor Templates & Starter Sites

Responsive Plus <= 3.2.2 - Cross-Site Request Forgery to Settings Update
4.3
CVE-2025-49856
Jun 12, 2025
Researcher: Chazz Wolcott
Responsive Plus <= 3.2.0 - Missing Authorization
4.3
CVE-2025-48335
May 29, 2025
Researcher: domiee13
Gutenberg & Elementor Templates Importer For Responsive <= 3.1.9 - Missing Authorization
5.3
CVE-2025-47486
May 7, 2025
Researcher: Marek Mikita
Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme <= 3.1.4 - Authenticated (Contributor+) Blind Server-Side Request Forgery via remote_request
5.4
CVE-2024-13834
Feb 14, 2025
Researcher: Francesco Carlucci
Responsive Addons – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme. <= 3.0.5 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVE-2024-5222
Jun 4, 2024
Researcher: wesley (wcraft)
Responsive Starter Templates – Elementor & WordPress Templates <= 2.6.8 - Authenticated (Admin+) Stored Cross-Site Scripting
5.5
CVE ID Unknown
Dec 13, 2022
Researchers:
Responsive Starter Templates – Elementor & WordPress Templates <= 2.6.8 - Authenticated (Admin+) Stored Cross-Site Scripting
5.5
CVE ID Unknown
Dec 13, 2022
Researchers:
Responsive Ready Sites Importer <= 2.2.6 - Unprotected AJAX Actions
9.1
CVE-2020-12073
Mar 4, 2020
Researcher: Chloe Chamberland
# Title CVE ID CVSS Researchers Date
1 Responsive Plus <= 3.2.2 - Cross-Site Request Forgery to Settings Update CVE-2025-49856 4.3 Chazz Wolcott June 12, 2025
2 Responsive Plus <= 3.2.0 - Missing Authorization CVE-2025-48335 4.3 domiee13 May 29, 2025
3 Gutenberg & Elementor Templates Importer For Responsive <= 3.1.9 - Missing Authorization CVE-2025-47486 5.3 Marek Mikita May 7, 2025
4 Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme <= 3.1.4 - Authenticated (Contributor+) Blind Server-Side Request Forgery via remote_request CVE-2024-13834 5.4 Francesco Carlucci February 14, 2025
5 Responsive Addons – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme. <= 3.0.5 - Authenticated (Author+) Stored Cross-Site Scripting CVE-2024-5222 6.4 wesley (wcraft) June 4, 2024
6 Responsive Starter Templates – Elementor & WordPress Templates <= 2.6.8 - Authenticated (Admin+) Stored Cross-Site Scripting 5.5 December 13, 2022
7 Responsive Starter Templates – Elementor & WordPress Templates <= 2.6.8 - Authenticated (Admin+) Stored Cross-Site Scripting 5.5 December 13, 2022
8 Responsive Ready Sites Importer <= 2.2.6 - Unprotected AJAX Actions CVE-2020-12073 9.1 Chloe Chamberland March 4, 2020
View more vulnerabilities in this software package View more vulnerabilities

This record contains material that is subject to copyright.

Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more.

Copyright 1999-2026 The MITRE Corporation

License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more.

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation