Skip to content
Noroxi

Sky Addons for Elementor

sky-elementor-addons · plugin

Known security vulnerabilities for Sky Addons for Elementor. Find out in seconds which version runs on your site with WP Lens.

11 known vulnerabilities

1 exploitable without logging in · latest Sep 11, 2026

Listed on wordpress.org · latest 4.0.0 · last updated Sep 18, 2026 · 2K+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2024-11601unauthenticated · needs a click≤ 2.6.1

    Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) <= 2.6.1 - Cross-Site Reque

    High 8.1

  • CVE-2024-11104subscriber+≤ 2.6.2

    Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) <= 2.6.2 - Missing Authoriz

    High 8.1

  • CVE-2026-62109editor+≤ 3.8.4

    WordPress Sky Addons for Elementor plugin <= 3.8.4 - SQL Injection vulnerability

    High 7.6

  • CVE-2025-46260login required≤ 3.0.1

    WordPress Sky Addons for Elementor plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2026-7475author+≤ 3.3.2

    Sky Addons <= 3.3.2 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Script

    Medium 6.4

  • CVE-2025-8216contributor+≤ 3.1.4

    Sky Addons for Elementor <= 3.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

    Medium 6.4

  • CVE-2024-50433login required≤ 2.5.15

    WordPress Sky Addons for Elementor plugin <= 2.5.15 - Cross Site Scripting (XSS) vulnerability

    Medium 5.4

  • CVE-2024-47332login required≤ 2.5.11

    WordPress Sky Addons for Elementor plugin <= 2.5.11 - Cross Site Scripting (XSS) vulnerability

    Medium 5.4

  • CVE-2024-38687login required≤ 2.5.5

    WordPress Sky Addons for Elementor plugin <= 2.5.5 - Cross Site Scripting (XSS) vulnerability

    Medium 5.4

  • CVE-2024-2286contributor+≤ 2.4.0

    Sky Addons for Elementor <= 2.4.0 - Authenticated(Contributor+) Stored Cross-site scripting via Wrapper Link URL

    Medium 5.4

  • CVE-2024-9542contributor+≤ 2.6.1

    Sky Addons for Elementor <= 2.6.1 - Authenticated (Contributor+) Sensitive Information Exposure via Content Switcher Widget Elementor Template

    Medium 4.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory