Exclusive Addons for Elementor
exclusive-addons-for-elementor · plugin
Known security vulnerabilities for Exclusive Addons for Elementor. Find out in seconds which version runs on your site with WP Lens.
29 known vulnerabilities
1 critical · 3 exploitable without logging in · 1 with public exploit code · latest Aug 2, 2026
Listed on wordpress.org · latest 2.8.1 · last updated Jul 24, 2026 · 50K+ installs
wordpress.org status checked on Oct 2, 2026
Vulnerabilities
- Critical 9.8
CVE-2024-33914login required≤ 2.6.9.1
WordPress Exclusive Addons for Elementor plugin <= 2.6.9.1 - Broken Access Control on Post Duplication vulnerability
- High 8.8
CVE-2022-45067unauthenticated · needs a click≤ 2.6.1
WordPress Exclusive Addons Elementor Plugin <= 2.6.1 is vulnerable to Cross Site Request Forgery (CSRF)
- Medium 6.5
CVE-2026-57620login required≤ 2.7.9.8
WordPress Exclusive Addons Elementor plugin <= 2.7.9.8 - Cross Site Scripting (XSS) vulnerability
- Medium 6.4
CVE-2026-12231contributor+≤ 2.7.9.8
Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'exad_infobox_image'
- Medium 6.4
CVE-2026-11328contributor+≤ 2.7.9.8
Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title
- Medium 5.9
CVE-2025-48244high privilege≤ 2.7.9
WordPress Exclusive Addons Elementor plugin <= 2.7.9 - Cross Site Scripting (XSS) Vulnerability
- Medium 5.4
CVE-2024-49292login required≤ 2.7.1
WordPress Exclusive Addons for Elementor plugin <= 2.7.1 - Cross-Site Scripting vulnerability
- Medium 5.4
CVE-2024-32557login required≤ 2.6.9.2
WordPress Exclusive Addons for Elementor plugin <= 2.6.9.2 - Cross Site Scripting (XSS) vulnerability
- Medium 5.4
CVE-2024-30177login required≤ 2.6.8
WordPress Exclusive Addons for Elementor plugin <= 2.6.8 - Cross Site Scripting (XSS) vulnerability
- Medium 5.4
CVE-2024-30232login required≤ 2.6.9
WordPress Exclusive Addons for Elementor plugin <= 2.6.9 - Cross Site Scripting (XSS) vulnerability
- Medium 5.4
CVE-2025-7498contributor+≤ 2.7.9.4
Exclusive Addons for Elementor <= 2.7.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown
- Medium 5.4
CVE-2025-4783contributor+≤ 2.7.9.1
Exclusive Addons for Elementor <= 2.7.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer Widget
- Medium 5.4
CVE-2025-1571contributor+≤ 2.7.6
Exclusive Addons for Elementor <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text and Image Comparison Widgets
- Medium 5.4
CVE-2024-5332contributor+≤ 2.6.9.8
Exclusive Addons for Elementor <= 2.6.9.8 - Authenticated (Contibutor+) Stored Cross-Site Scripting via Card Widget
- Medium 5.4
CVE-2024-4618contributor+≤ 2.6.9.6
Exclusive Addons for Elementor <= 2.6.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Widget
- Medium 5.4
CVE-2024-3985contributor+≤ 2.6.9.4
Exclusive Addons for Elementor <= 2.6.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call to Action
- Medium 5.4
CVE-2024-3489contributor+≤ 2.6.9.4
Exclusive Addons for Elementor <= 2.6.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Expired Title
- Medium 5.4
CVE-2024-2751contributor+≤ 2.6.9.2
Exclusive Addons for Elementor <= 2.6.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via InfoBox
- Medium 5.4
CVE-2024-2750contributor+≤ 2.6.9.3
Exclusive Addons for Elementor <= 2.6.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget
- Medium 5.4
CVE-2024-2503contributor+≤ 2.6.9.2
Exclusive Addons for Elementor <= 2.6.9.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Post Grid
- Medium 5.4
CVE-2024-2028contributor+≤ 2.6.9
Exclusive Addons for Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Covid-19 Stats Widget
- Medium 5.4
CVE-2024-1414contributor+≤ 2.6.9
Exclusive Addons for Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call To Action Widget
- Medium 5.4
CVE-2024-1413contributor+≤ 2.6.9
Exclusive Addons for Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer Widget
- Medium 5.4
CVE-2024-1234contributor+≤ 2.6.9
Exclusive Addons for Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Medium 5.4
CVE-2024-0823contributor+≤ 2.6.8
Exclusive Addons for Elementor <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Medium 5.4
CVE-2024-0824contributor+≤ 2.6.8
Exclusive Addons for Elementor <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Link Anything
- Medium 5.3
CVE-2026-66438unauthenticated≤ 2.8.0
WordPress Exclusive Addons Elementor plugin <= 2.8.0 - Sensitive Data Exposure vulnerability
- Medium 5.3
CVE-2026-59511unauthenticated≤ 2.7.9.9
WordPress Exclusive Addons Elementor plugin <= 2.7.9.9 - Sensitive Data Exposure vulnerability
- Medium 4.3
CVE-2024-10312contributor+≤ 2.7.4
Exclusive Addons for Elementor <= 2.7.4 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates
The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).