WordSec
WordSec

Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons

Explore Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons vulnerabilities across all versions. Currently tracking 38 known vulnerabilities, including severity, impact, and patch status.

01234567891002.02.2024Today02.02.20244.3Element Pack Elementor Addons <= 5.4.11 - Missing Authorization via bdt_duplicate_as_draft CVSS 4.3 · 02.02.202425.03.20246.4Element Pack Elementor Addons <= 5.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via link CVSS 6.4 · 25.03.202428.03.20249.9Element Pack Elementor Addons <= 5.5.3 - Authenticated (Contributor+) SQL Injection CVSS 9.9 · 28.03.202405.04.20246.4Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Custom Gallery' Widget CVSS 6.4 · 05.04.20246.4Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Trailer Box Widget CVSS 6.4 · 05.04.202410.04.20245.3Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.5.6 - Sensitive Information Exposure via element_pack_ajax_search CVSS 5.3 · 10.04.202417.04.20246.4Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Panel Slider Widget CVSS 6.4 · 17.04.20246.4Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Price List Widget CVSS 6.4 · 17.04.202421.05.20246.4Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via custom_attributes CVSS 6.4 · 21.05.20245.3Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.3 - Form Submission Admin Email Bypass CVSS 5.3 · 21.05.202411.06.20246.4Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via onclick events CVSS 6.4 · 11.06.202417.07.20246.4Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 17.07.20246.4Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 17.07.202401.08.20246.4Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 01.08.202408.08.20246.4Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag CVSS 6.4 · 08.08.20246.5Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.2 - Authenticated (Contributor+) Arbitrary File Read CVSS 6.5 · 08.08.202412.08.20246.4Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Gallery and Countdown Widgets CVSS 6.4 · 12.08.202430.09.20246.4Element Pack Elementor Addons <= 5.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 30.09.202401.11.20245.4Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Age Gate CVSS 5.4 · 01.11.20246.4Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Custom Gallery Widget CVSS 6.4 · 01.11.202404.11.20245.4Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Map Widget CVSS 5.4 · 04.11.20246.5Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting CVSS 6.5 · 04.11.202407.11.20246.4Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 07.11.202414.11.20246.4Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Cookie Consent' CVSS 6.4 · 14.11.202402.12.20246.4Element Pack Elementor Addons <= 5.10.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Lightbox Widget CVSS 6.4 · 02.12.202421.12.20244.3Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.12 - Missing Authorization CVSS 4.3 · 21.12.202407.01.20256.4Element Pack Lite - Addons for Elementor <= 5.10.14 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 07.01.202518.04.20256.4Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.28 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting CVSS 6.4 · 18.04.202525.04.20256.4Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.29 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 25.04.202530.05.20256.4Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder <= 5.11.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting CVSS 6.4 · 30.05.202502.07.20256.4Element Pack Addons for Elementor <= 8.0.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via data-caption Attribute CVSS 6.4 · 02.07.202505.08.20255.4Element Pack Elementor Addons and Templates <= 8.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map Widget Marker Content CVSS 5.4 · 05.08.202520.10.20255.0Element Pack Addons for Elementor <= 8.2.5 - Authenticated (Subscriber+) Blind Server-Side Request Forgery CVSS 5.0 · 20.10.202517.11.20255.4Element Pack Addons for Elementor <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map widget CVSS 5.4 · 17.11.202516.01.20264.3Element Pack Elementor Addons <= 8.3.13 - Cross-Site Request Forgery CVSS 4.3 · 16.01.202614.02.20266.5Element Pack Addons for Elementor <= 8.3.17 - Authenticated (Contributor+) Arbitrary File Read CVSS 6.5 · 14.02.202623.03.20264.9Element Pack Elementor Addons <= 8.4.2 - Authenticated (Editor+) SQL Injection CVSS 4.9 · 23.03.202607.04.20266.4Element Pack Addons for Elementor <= 8.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Image Widget CVSS 6.4 · 07.04.2026

Strategic Overview

Avg CVSSMedium
6.1/ 10
Patch Coverage100%
Open

0

Fixed

38

Get automatic notifications for all Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons vulnerabilities before they are exploited.

Vulnerability Records

38 records
2026-04-07 19:36
Element Pack Addons for Elementor <= 8.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Image Widget
Element Pack Addons for Elementor
<= 8.4.2
CVE-2026-4655
6.4
Medium
WebbernautYes
2026-03-23 00:00
Element Pack Elementor Addons <= 8.4.2 - Authenticated (Editor+) SQL Injection
Element Pack Addons for Elementor
<= 8.4.2
CVE-2026-40745
4.9
Medium
darooYes
2026-02-14 14:34
Element Pack Addons for Elementor <= 8.3.17 - Authenticated (Contributor+) Arbitrary File Read
Element Pack Addons for Elementor
<= 8.3.17
CVE-2026-1793
6.5
Medium
Chiao-Lin Yu (Steven Meow)Yes
2026-01-16 00:00
Element Pack Elementor Addons <= 8.3.13 - Cross-Site Request Forgery
Element Pack Addons for Elementor
<= 8.3.13
CVE-2025-31413
4.3
Medium
Arif ShaikhYes
2025-11-17 20:54
Element Pack Addons for Elementor <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map widget
Element Pack Addons for Elementor
<= 8.3.4
CVE-2025-13196
5.4
Medium
zer0gh0stYes
2025-10-20 08:59
Element Pack Addons for Elementor <= 8.2.5 - Authenticated (Subscriber+) Blind Server-Side Request Forgery
Element Pack Addons for Elementor
<= 8.2.5
CVE-2025-11536
5.0
Medium
LionTreeYes
2025-08-05 00:00
Element Pack Elementor Addons and Templates <= 8.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map Widget Marker Content
Element Pack Addons for Elementor
<= 8.1.5
CVE-2025-8100
5.4
Medium
zer0gh0stYes
2025-07-02 16:23
Element Pack Addons for Elementor <= 8.0.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via data-caption Attribute
Element Pack Addons for Elementor
8.0.0
CVE-2025-5944
6.4
Medium
WebbernautYes
2025-05-30 00:00
Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder <= 5.11.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
Element Pack Addons for Elementor
<= 5.11.2
CVE-2025-5292
6.4
Medium
Robert DeVoreYes
2025-04-25 00:00
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.29 - Authenticated (Contributor+) Stored Cross-Site Scripting
Element Pack Addons for Elementor
<= 5.10.29
CVE-2025-1458
6.4
Medium
zer0gh0stYes
Showing 1–10 of 38 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C