CVE-2026-0673

Name of the Vulnerable Software and Affected Versions Element Pack Addons for Elementor versions prior to 8.3.16

Description An Email Header Injection issue exists due to insufficient sanitization of newline characters in user-supplied input that is concatenated into email headers. This allows unauthenticated attackers to inject arbitrary email headers into emails sent via the element pack contact form AJAX action.

Recommendations Update the plugin to version 8.3.16 or later. As a temporary mitigation, restrict access to the element pack contact form AJAX action.