CVE-2023-3779

The Essential Addons For Elementor plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 5.8.1 due to the plugin adding the API key to the source code of any page running the MailChimp block. This makes it possible for unauthenticated attackers to obtain a site's MailChimp API key. We recommend resetting any MailChimp API keys if running a vulnerable version of this plugin with the MailChimp block enabled as the API key may have been compromised. This only affects sites running the premium version of the plugin and that have the Mailchimp block enabled on a page.

• CWE-200

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2938177%40essential-addons-for-elementor-lite&new=2938177%40essential-addons-for-elementor-lite&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e007c713-74bc-4ff5-a198-70dcc8a8ee68?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2938177%40essential-addons-for-elementor-lite&new=2938177%40essential-addons-for-elementor-lite&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e007c713-74bc-4ff5-a198-70dcc8a8ee68?source=cveThird Party Advisory

Published

Jul 20, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-37777A SQL injection vulnerability exists in Synnefo Internet Man…9.8
• CVE-2023-37781An issue in the emqx_sn plugin of EMQX v4.3.8 allows attacke…6.5
• CVE-2023-37785A cross-site scripting (XSS) vulnerability in ImpressCMS v1.…4.8
• CVE-2023-37786Multiple cross-site scripting (XSS) vulnerabilities in Geekl…4.8
• CVE-2023-37787Multiple cross-site scripting (XSS) vulnerabilities in Geekl…4.8
• CVE-2023-37788goproxy v1.1 was discovered to contain an issue which can le…7.5
• CVE-2023-37790Jaspersoft Clarity PPM version 14.3.0.298 was discovered to …5.4
• CVE-2023-37791D-Link DIR-619L v2.04(TW) was discovered to contain a stack …9.8
• CVE-2023-37793WAYOS FBM-291W 19.09.11V was discovered to contain a buffer …9.8
• CVE-2023-37794WAYOS FBM-291W 19.09.11V was discovered to contain a command…9.8
• CVE-2023-37798A stored cross-site scripting (XSS) vulnerability in the new…5.4
• CVE-2023-37800Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…