Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates

premium-addons-for-elementor · plugin

Known security vulnerabilities for Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates. Find out in seconds which version runs on your site with WP Lens.

39 known vulnerabilities

3 exploitable without logging in · 1 with public exploit code · latest Sep 30, 2026

Listed on wordpress.org · latest 4.11.110 · last updated Oct 1, 2026 · 600K+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

CVE-2024-56225login required≤ 4.10.56
WordPress Premium Addons for Elementor plugin <= 4.10.56 - Broken Access Control vulnerability
High 8.8
CVE-2024-31278login required≤ 4.10.22
WordPress Premium Addons for Elementor plugin <= 4.10.22 - Sensitive Data Exposure vulnerability
Medium 6.5
CVE-2026-62078contributor+≤ 4.11.105
WordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vulnerability
Medium 6.5
CVE-2026-94168contributor+≤ 4.11.105
WordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vulnerability
Medium 6.5
CVE-2024-3647contributor+≤ 4.10.28
Premium Addons for Elementor <= 4.10.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'arrow_style'
Medium 6.4
CVE-2024-2665contributor+≤ 4.10.27
Premium Addons for Elementor <= 4.10.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button
Medium 6.4
CVE-2024-2664contributor+≤ 4.10.24
Premium Addons for Elementor <= 4.10.24 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium 6.4
CVE-2024-0326contributor+≤ 4.0.17
Premium Addons for Elementor <= 4.10.17 - Authenticated(Contributor+) Stored Cross-Site Scripting via Link Wrapper
Medium 6.4
CVE-2024-1242contributor+≤ 4.10.18
Premium Addons for Elementor <= 4.10.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium 6.4
CVE-2025-69300login required≤ 4.11.63
WordPress Premium Addons for Elementor plugin <= 4.11.63 - Settings Change vulnerability
Medium 5.4
CVE-2024-37922login required≤ 4.10.34
WordPress Premium Addons for Elementor plugin <= 4.10.34 - Cross Site Scripting (XSS) vulnerability
Medium 5.4
CVE-2024-32791login required≤ 4.10.25
WordPress Premium Addons for Elementor plugin <= 4.10.25 - Cross Site Scripting (XSS) vulnerability
Medium 5.4
CVE-2024-29106login required≤ 4.10.16
WordPress Premium Addons for Elementor plugin <= 4.10.16 - Cross Site Scripting (XSS) vulnerability
Medium 5.4
CVE-2024-24831login required≤ 4.10.16
WordPress Premium Addons for Elementor plugin <= 4.10.16 - Cross Site Scripting (XSS) vulnerability
Medium 5.4
CVE-2026-4790contributor+≤ 4.11.70
Premium Addons for Elementor <= 4.11.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_svg' Parameter
Medium 5.4
CVE-2024-11937contributor+≤ 4.10.69
Premium Addons for Elementor <= 4.10.69 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium 5.4
CVE-2025-4774contributor+≤ 4.11.8
Premium Addons for Elementor <= 4.11.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
Medium 5.4
CVE-2024-10266contributor+≤ 4.10.60
Premium Addons for Elementor <= 4.10.60 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Box Widget
Medium 5.4
CVE-2024-8681contributor+≤ 4.10.52
Premium Addons for Elementor <= 4.10.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Media Grid Widget
Medium 5.4
CVE-2024-6495contributor+≤ 4.10.36
Premium Addons for Elementor <= 4.10.36 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Animated Text Widget
Medium 5.4
CVE-2024-6340contributor+≤ 4.10.36
Premium Addons for Elementor <= 4.10.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
Medium 5.4
CVE-2024-5553contributor+≤ 4.10.33
Premium Addons for Elementor <= 4.10.33 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
Medium 5.4
CVE-2024-4379contributor+≤ 4.10.31
Premium Addons for Elementor <= 4.10.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Global Tooltip
Medium 5.4
CVE-2024-4376contributor+≤ 4.10.31
Premium Addons for Elementor <= 4.10.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget
Medium 5.4
CVE-2024-4378contributor+≤ 4.10.31
Premium Addons for Elementor <= 4.10.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Menu and Shape Divider
Medium 5.4
CVE-2024-4203contributor+≤ 4.10.30
Premium Addons for Elementor <= 4.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium 5.4
CVE-2024-3885contributor+≤ 4.10.28
Premium Addons for Elementor <= 4.10.28 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium 5.4
CVE-2024-2666contributor+≤ 4.10.24
Premium Addons for Elementor <= 4.10.24 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
Medium 5.4
CVE-2024-0376contributor+≤ 4.10.16
Premium Addons for Elementor <= 4.10.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via Wrapper Link Widget
Medium 5.4
CVE-2024-2399contributor+≤ 4.10.23
Premium Addons for Elementor <= 4.10.23 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium 5.4
CVE-2024-1680contributor+≤ 4.10.21
Premium Addons for Elementor <= 4.10.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Banner, Team Members, and Image Scroll Widgets
Medium 5.4
CVE-2025-68494unauthenticated≤ 4.11.53
WordPress Premium Addons for Elementor plugin <= 4.11.53 - Sensitive Data Exposure vulnerability
Medium 5.3
CVE-2025-14155unauthenticated≤ 4.11.53
Premium Addons for Elementor <= 4.11.53 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'get_template_content'
Medium 5.3
CVE-2026-12141contributor+≤ 4.11.84
Premium Addons for Elementor <= 4.11.84 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'premium_tooltip_text' Parameter
Medium 4.9
CVE-2025-14163unauthenticated · needs a click≤ 4.11.53
Premium Addons for Elementor <= 4.11.53 - Cross-Site Request Forgery via 'insert_inner_template'
Medium 4.3
CVE-2021-4445subscriber+≤ 4.5.1
Premium Addons for Elementor <= 4.5.1 - Authenticated (Subscriber+) Limited Arbitrary Option Update
Medium 4.3
CVE-2024-4205subscriber+≤ 4.10.31
Premium Addons for Elementor <= 4.10.31 - Missing Authorization to Information Disclosure
Medium 4.3
CVE-2024-6824contributor+≤ 4.10.38
Premium Addons for Elementor <= 4.10.38 - Missing Authorization to Authenticated (Contributor+) Arbitrary Content Deletion and Arbitrary Title Update
Medium 4.3
CVE-2024-6434author+≤ 4.10.35
Premium Addons for Elementor <= 4.10.35 - Regular Expressions Denial of Service
Medium 4.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory