Essential Addons for Elementor – Popular Elementor Templates & Widgets

Vulnerabilities

• CVE-2023-32243unauthenticated≤ 5.7.1

  WordPress Essential Addons for Elementor Plugin 5.4.0-5.7.1 is vulnerable to Privilege Escalation

  Critical 9.8

• CVE-2026-15155contributor+≤ 6.6.10

  Essential Addons for Elementor <= 6.6.10 - Authenticated (Contributor+) Account Takeover via Email Header Injection

  High 8.8

• CVE-2021-4447contributor+≤ 4.6.4

  Essential Addons for Elementor <= 4.6.4 - Authenticated (Contributor+) Privilege Escalation

  High 8.8

• CVE-2023-41955contributor+≤ 5.8.8

  WordPress Essential Addons for Elementor plugin <= 5.8.8 - Contributor+ Privilege Escalation vulnerability

  High 8.8

• CVE-2024-3018author+≤ 5.9.13

  Essential Addons for Elementor <= 5.9.13 - Authenticated (Author+) PHP Object Injection via error_resetpassword

  High 8.8

• CVE-2024-1536contributor+≤ 5.9.9

  Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Script

  High 7.4

• CVE-2026-102394login required≤ 6.8.4

  WordPress Essential Addons for Elementor plugin <= 6.8.4 - Cross Site Scripting (XSS) vulnerability

  Medium 6.5

• CVE-2025-69092login required≤ 6.5.3

  WordPress Essential Addons for Elementor plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability

  Medium 6.5

• CVE-2025-39590login required≤ 6.1.9

  WordPress Essential Addons for Elementor plugin <= 6.1.9 - Cross Site Scripting (XSS) Vulnerability

  Medium 6.5

• CVE-2026-5193author+≤ 6.5.13

  Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.5.13 - Authenticated (Author+) Limited Privilege Escalation via register_user

  Medium 6.5

• CVE-2026-15145contributor+≤ 6.6.11

  Essential Addons for Elementor <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget

  Medium 6.4

• CVE-2026-15156contributor+≤ 6.6.11

  Essential Addons for Elementor <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Reading Progress Global Color Settings

  Medium 6.4

• CVE-2026-6459author+≤ 6.6.2

  Essential Addons for Elementor <= 6.6.2 - Authenticated (Author+) Stored Cross-Site Scripting via Event Calendar Widget Popup

  Medium 6.4

• CVE-2026-1512contributor+≤ 6.5.9

  Essential Addons for Elementor <= 6.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box Widget

  Medium 6.4

• CVE-2025-13977contributor+≤ 6.5.3

  Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Medium 6.4

• CVE-2025-8451contributor+≤ 6.2.2

  Essential Addons for Elementor – Popular Elementor Templates and Widgets <= 6.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'data

  Medium 6.4

• CVE-2024-4448contributor+≤ 5.9.19

  Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.19 - Authenticated (Contributor+) Stored Cross-Site Scrip

  Medium 6.4

• CVE-2024-3728contributor+≤ 5.9.15

  Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scrip

  Medium 6.4

• CVE-2024-3333contributor+≤ 5.9.14

  Essential Addons for Elementor <= 5.9.14 - Authenticated (Contributor+) Store Cross-Site Scripting via Widget URL Attribute

  Medium 6.4

• CVE-2024-2650contributor+≤ 5.9.11

  Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scrip

  Medium 6.4

• CVE-2024-2623contributor+≤ 5.9.11

  Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scrip

  Medium 6.4

• CVE-2024-1537contributor+≤ 5.9.9

  Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Script

  Medium 6.4

• CVE-2024-1276contributor+≤ 5.9.8

  Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Script

  Medium 6.4

• CVE-2024-1236contributor+≤ 5.9.8

  Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Script

  Medium 6.4

• CVE-2024-0586contributor+≤ 5.9.4

  Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.4 - Authenticated (Contributor+) Stored Cross-Site Scritp

  Medium 6.4

• CVE-2025-24752unauthenticated · needs a click≤ 6.0.14

  WordPress Essential Addons for Elementor plugin <= 6.0.14 - Reflected Cross Site Scripting (XSS) vulnerability

  Medium 6.1

• CVE-2022-0683unauthenticated · needs a click≤ 5.0.8

  Essential Addons for Elementor Lite <= 5.0.8 Reflected Cross-Site Scripting

  Medium 6.1

• CVE-2024-8979author+≤ 6.0.9

  Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.9 - Authenticated (Author+) Sensitive Information

  Medium 5.7

• CVE-2024-8978contributor+≤ 6.0.9

  Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.9 - Authenticated (Contributor+) Sensitive Informa

  Medium 5.7

• CVE-2024-56063login required≤ 6.0.7

  WordPress Essential Addons for Elementor plugin <= 6.0.7 - Cross Site Scripting (XSS) vulnerability

  Medium 5.4

• CVE-2024-39649login required≤ 5.9.26

  WordPress Essential Addons for Elementor plugin <= 5.9.26 - Cross Site Scripting (XSS) vulnerability

  Medium 5.4

• CVE-2024-9994contributor+≤ 6.1.12

  Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 6.1.12 - Authenticated(Contributor+) Stored Cross-Site Script

  Medium 5.4

• CVE-2024-9993contributor+≤ 6.1.12

  Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 6.1.12 - Authenticated(Contributor+) Stored Cross-Site Script

  Medium 5.4

• CVE-2024-8961contributor+≤ 6.0.7

  Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.7 - Authenticated (Contributor+) Stored Cross-Site

  Medium 5.4

• CVE-2024-8742contributor+≤ 6.0.3

  Essential Addons for Elementor <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery Widget

  Medium 5.4

• CVE-2024-8440contributor+≤ 6.0.3

  Essential Addons for Elementor -- Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scrip

  Medium 5.4

• CVE-2024-7092contributor+≤ 5.9.27

  Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.27 - Authenticated (Contributor+) Stored Cross-Site Scrip

  Medium 5.4

• CVE-2024-5189contributor+≤ 5.9.23

  Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.23 - Authenticated (Contributor+) Stored Cross-Site Scrip

  Medium 5.4

• CVE-2024-5188contributor+≤ 5.9.22

  Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.22 - Authenticated (Contributor+) Stored Cross-Site Scrip

  Medium 5.4

• CVE-2024-5073contributor+≤ 5.9.21

  Essential Addons for Elementor <= 5.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Feed

  Medium 5.4

• CVE-2024-4624contributor+≤ 5.9.20

  Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.20 - Authenticated (Contributor+) Stored Cross-Site Scrip

  Medium 5.4

• CVE-2024-4449contributor+≤ 5.9.19

  Essential Addons for Elementor <= 5.9.19 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Several Widgets

  Medium 5.4

• CVE-2024-4275contributor+≤ 5.9.19

  Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.19 - Authenticated (Contributor+) Stored Cross-Site Scrip

  Medium 5.4

• CVE-2024-4156contributor+≤ 5.9.17

  Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.17 - Authenticated (Contributor+) Stored Cross-Site Scrip

  Medium 5.4

• CVE-2024-4003contributor+≤ 5.9.15

  Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scrip

  Medium 5.4

• CVE-2024-1172contributor+≤ 5.9.8

  Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Script

  Medium 5.4

• CVE-2024-1171contributor+≤ 5.9.8

  Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Script

  Medium 5.4

• CVE-2024-0954contributor+≤ 5.9.7

  Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.7 - Authenticated (Contributor+) Stored Cross-Site Script

  Medium 5.4

• CVE-2024-0585contributor+≤ 5.9.4

  Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.4 - Authenticated (Contributor+) Stored Cross-Site Script

  Medium 5.4

• CVE-2023-7044contributor+≤ 5.9.2

  Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.2 - Authenticated (Contributor+) Stored Cross-Site Script

  Medium 5.4

• CVE-2026-81777unauthenticated≤ 6.8.0

  WordPress Essential Addons for Elementor plugin <= 6.8.0 - Bypass vulnerability vulnerability

  Medium 5.3

• CVE-2026-25440unauthenticated→ 6.6.0

  WordPress Essential Addons for Elementor plugin < 6.6.0 - Broken Access Control vulnerability

  Medium 5.3

• CVE-2026-7665unauthenticated≤ 6.6.4

  Essential Addons for Elementor <= 6.6.4 - Missing Authorization to Unauthenticated Information Exposure via 'load_more' AJAX Handler

  Medium 5.3

• CVE-2026-23543unauthenticated≤ 6.5.5

  WordPress Essential Addons for Elementor plugin <= 6.5.5 - Broken Access Control vulnerability

  Medium 5.3

• CVE-2026-1004unauthenticated≤ 6.5.5

  Essential Addons for Elementor <= 6.5.5 - Missing Authorization to Unauthenticated Sensitive Information Exposure

  Medium 5.3

• CVE-2024-3733unauthenticated≤ 5.9.15

  Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Information Exposure

  Medium 5.3

• CVE-2024-2974unauthenticated≤ 5.9.13

  Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.13 - Unauthenticated Sensitive Information Exposure

  Medium 5.3

• CVE-2023-3779unauthenticated≤ 5.8.1

  Essential Addons For Elementor <=5.8.1 - Unauthenticated MailChimp API Key Disclosure

  Medium 5.3

• CVE-2025-39589login required≤ 6.1.9

  WordPress Essential Addons for Elementor plugin <= 6.1.9 - Sensitive Data Exposure Vulnerability

  Medium 4.3

• CVE-2021-4446subscriber+≤ 4.6.4

  Essential Addons for Elementor <= 4.6.4 - Missing Authorization

  Medium 4.3

• CVE-2025-64352high privilege≤ 6.2.4

  WordPress Essential Addons for Elementor plugin <= 6.2.4 - Broken Access Control vulnerability

  Low 2.7