Ele Conditions for Elementor
Ele Conditions for Elementor has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 4.4, and the most serious one scores 4.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Ele Conditions for Elementor has a vendor fix available, so running the current release closes it.
All of these findings were reported by Que Thanh Tuan - Blue Rock. Ele Conditions for Elementor is installed on roughly 3,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.
CVE-2025-58796Elementor Element Condition <= 1.0.6 - Authenticated (Editor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records

Ele Conditions for Elementor
Author
dudaster
Ele Conditions for Elementor turns static Elementor elements into interactive, context-aware components — without writing a single line of code. There are two independent systems, both accessible from the Advanced tab of any widget, section, or container: ⚡ Triggers & Actions (client-side, no page reload) Attach one or more trigger → action pairs to any element. 10 trigger types: Click — user clicks the element Hover — user hovers over the element Delay on load — fires after X milliseconds from page load Scroll into view — fires once when the element enters the viewport Time on page — fires after X seconds the visitor has been on the page Exit intent — fires when the cursor moves toward closing the tab First visit — fires only on the visitor’s very first page load (localStorage) Nth visit — fires on the Nth page load (visit counter in localStorage) A/B Group A / B — fires for visitors randomly assigned to group A or B (persists via localStorage) 9 action types: Show — make the target element visible Hide — hide the target element Toggle — toggle visibility on each trigger Add / Remove / Toggle Class — apply a CSS class (great for CSS animations) Scroll To — smooth-scroll the page to the target element Focus — set browser focus on the target (input fields, etc.) Close Others in Group — hide all siblings sharing a CSS class (accordion pattern) Target selector: leave empty to act on the element itself, or enter any CSS selector to act on another element anywhere on the page. Hide Initially: a dedicated switcher that hides the element on load independently of triggers — useful for elements revealed by a trigger. 🎛 Display Conditions (server-side, evaluated at render time) Show or hide elements based on variables, rules, and time windows. Multiple conditions per element with AND / OR logic. Built-in variables include: user_role, is_logged_in, user_id, post_type, post_status, post_age_days, post_word_count, post_has_thumbnail, cart_count, cart_total, current_hour, current_day, current_month, current_year, utm_source, utm_medium, utm_campaign, utm_content, utm_term, and more. Condition types: Simple — compare a variable to a value using ==, !=, >, <, >=, <=, contains, starts_with, ends_with, empty, not_empty Time interval — show element only between two times of day (supports cross-midnight ranges) Date/datetime interval — show element only within a date or datetime window Custom variables — register your own variables via the eleconditions_vars filter in your theme’s functions.php. ACF support — pick any ACF field from a searchable dropdown; the value is fetched at render time. User meta — condition on any WordPress user meta key for the current visitor. Debug mode — shows a red-bordered overlay with the evaluated variable values, visible only to editors and administrators. Developer-friendly Zero dependencies beyond Elementor Fully filterable variable system No inline styles injected into saved content — everything is evaluated at render Note: Requires the free Elementor plugin.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C