Spexo Addons for Elementor – Elementor Widgets, Mega Menu, Popup Builder, Template Kits and Starter Templates for Elementor
sastra-essential-addons-for-elementor · plugin
Known security vulnerabilities for Spexo Addons for Elementor – Elementor Widgets, Mega Menu, Popup Builder, Template Kits and Starter Templates for Elementor. Find out in seconds which version runs on your site with WP Lens.
3 known vulnerabilities
latest Aug 24, 2025
Listed on wordpress.org · latest 1.0.38 · last updated Jul 18, 2026 · 6K+ installs
wordpress.org status checked on Oct 2, 2026
Vulnerabilities
- Medium 6.5
CVE-2024-51674login required≤ 1.0.5
WordPress Sastra Essential Addons for Elementor plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability
- Medium 6.4
CVE-2025-8208contributor+≤ 1.0.23
Spexo Addons for Elementor <= 1.0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
- Medium 4.3
CVE-2024-13335subscriber+≤ 1.0.14
Sastra Essential Addons for Elementor – Free Elementor Addons, Widgets and Templates <= 1.0.14 - Missing Authorization to Spexo Theme Install
The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).