# bdthemes Element Pack – Widgets, Templates & Addons for Elementor.

Every CVE that names bdthemes Element Pack – Widgets, Templates & Addons for Elementor among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Element Pack Addons for Elementor <= 8.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Image Widget](https://agentprime.io/advisories/CVE-2026-4655.md)
  `CVE-2026-4655` · CVE record: bdthemes Element Pack – Widgets, Templates & Addons for Elementor · CVSS 6.4 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Cross-site scripting (XSS)
- [Element Pack Addons for Elementor <= 8.3.17 - Authenticated (Contributor+) Arbitrary File Read](https://agentprime.io/advisories/CVE-2026-1793.md)
  `CVE-2026-1793` · CVE record: bdthemes Element Pack – Widgets, Templates & Addons for Elementor · CVSS 6.5 Medium · Not analysed yet · Published 15 Feb 2026 · Tags: Path traversal
- [Element Pack Addons for Elementor <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map widget](https://agentprime.io/advisories/CVE-2025-13196.md)
  `CVE-2025-13196` · CVE record: bdthemes Element Pack – Widgets, Templates & Addons for Elementor · CVSS 5.4 Medium · Not analysed yet · Published 18 Nov 2025 · Tags: Cross-site scripting (XSS)
- [Element Pack Addons for Elementor <= 8.2.5 - Authenticated (Subscriber+) Blind Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2025-11536.md)
  `CVE-2025-11536` · CVE record: bdthemes Element Pack – Widgets, Templates & Addons for Elementor · CVSS 5.0 Medium · Not analysed yet · Published 20 Oct 2025 · Tags: Server-side request forgery (SSRF)
- [Element Pack Elementor Addons and Templates <= 8.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map Widget Marker Content](https://agentprime.io/advisories/CVE-2025-8100.md)
  `CVE-2025-8100` · CVE record: bdthemes Element Pack – Widgets, Templates & Addons for Elementor · CVSS 5.4 Medium · Not analysed yet · Published 6 Aug 2025 · Tags: Cross-site scripting (XSS)
- [Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder <= 5.11.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-5292.md)
  `CVE-2025-5292` · CVE record: bdthemes Element Pack – Widgets, Templates & Addons for Elementor · CVSS 6.4 Medium · Not analysed yet · Published 31 May 2025 · Tags: Cross-site scripting (XSS)
- [Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.29 - Authenticated (Contributor+) Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-1458.md)
  `CVE-2025-1458` · CVE record: bdthemes Element Pack – Widgets, Templates & Addons for Elementor · CVSS 6.4 Medium · Not analysed yet · Published 26 Apr 2025 · Tags: Cross-site scripting (XSS)
- [Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.28 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-1457.md)
  `CVE-2025-1457` · CVE record: bdthemes Element Pack – Widgets, Templates & Addons for Elementor · CVSS 6.4 Medium · Not analysed yet · Published 19 Apr 2025 · Tags: Cross-site scripting (XSS)
- [Element Pack Lite - Addons for Elementor <= 5.10.14 - Authenticated (Contributor+) Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2024-12851.md)
  `CVE-2024-12851` · CVE record: bdthemes Element Pack – Widgets, Templates & Addons for Elementor · CVSS 6.4 Medium · Not analysed yet · Published 8 Jan 2025 · Tags: Cross-site scripting (XSS)
- [Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.12 - Missing Authorization](https://agentprime.io/advisories/CVE-2024-11852.md)
  `CVE-2024-11852` · CVE record: bdthemes Element Pack – Widgets, Templates & Addons for Elementor · CVSS 4.3 Medium · Not analysed yet · Published 22 Dec 2024 · Tags: Broken access control
- [Element Pack Elementor Addons <= 5.10.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Lightbox Widget](https://agentprime.io/advisories/CVE-2024-9058.md)
  `CVE-2024-9058` · CVE record: bdthemes Element Pack – Widgets, Templates & Addons for Elementor · CVSS 6.4 Medium · Not analysed yet · Published 3 Dec 2024 · Tags: Cross-site scripting (XSS)
- [Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Map Widget](https://agentprime.io/advisories/CVE-2024-9867.md)
  `CVE-2024-9867` · CVE record: bdthemes Element Pack – Widgets, Templates & Addons for Elementor · CVSS 5.4 Medium · Not analysed yet · Published 5 Nov 2024 · Tags: Cross-site scripting (XSS)
- [Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2024-9657.md)
  `CVE-2024-9657` · CVE record: bdthemes Element Pack – Widgets, Templates & Addons for Elementor · CVSS 6.5 Medium · Not analysed yet · Published 5 Nov 2024 · Tags: Cross-site scripting (XSS)
- [Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Age Gate](https://agentprime.io/advisories/CVE-2024-9868.md)
  `CVE-2024-9868` · CVE record: bdthemes Element Pack – Widgets, Templates & Addons for Elementor · CVSS 5.4 Medium · Not analysed yet · Published 2 Nov 2024 · Tags: Cross-site scripting (XSS)
- [Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Custom Galle…](https://agentprime.io/advisories/CVE-2024-10310.md)
  `CVE-2024-10310` · CVE record: bdthemes Element Pack – Widgets, Templates & Addons for Elementor · CVSS 6.4 Medium · Not analysed yet · Published 2 Nov 2024 · Tags: Cross-site scripting (XSS)
- [Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Gallery and Coun…](https://agentprime.io/advisories/CVE-2024-7247.md)
  `CVE-2024-7247` · CVE record: bdthemes Element Pack – Widgets, Templates & Addons for Elementor · CVSS 6.4 Medium · Not analysed yet · Published 13 Aug 2024 · Tags: Cross-site scripting (XSS)
- [Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.2 - Authenticated (Contributor+) Arbitrary File Read](https://agentprime.io/advisories/CVE-2024-4359.md)
  `CVE-2024-4359` · CVE record: bdthemes Element Pack – Widgets, Templates & Addons for Elementor · CVSS 6.5 Medium · Not analysed yet · Published 9 Aug 2024 · Tags: File inclusion
- [Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag](https://agentprime.io/advisories/CVE-2024-4360.md)
  `CVE-2024-4360` · CVE record: bdthemes Element Pack – Widgets, Templates & Addons for Elementor · CVSS 6.4 Medium · Not analysed yet · Published 9 Aug 2024 · Tags: Cross-site scripting (XSS)
- [Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2024-4643.md)
  `CVE-2024-4643` · CVE record: bdthemes Element Pack – Widgets, Templates & Addons for Elementor · CVSS 6.4 Medium · Not analysed yet · Published 2 Aug 2024 · Tags: Cross-site scripting (XSS)
- [Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2024-5555.md)
  `CVE-2024-5555` · CVE record: bdthemes Element Pack – Widgets, Templates & Addons for Elementor · CVSS 6.4 Medium · Not analysed yet · Published 18 Jul 2024 · Tags: Cross-site scripting (XSS)
- [Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2024-5554.md)
  `CVE-2024-5554` · CVE record: bdthemes Element Pack – Widgets, Templates & Addons for Elementor · CVSS 6.4 Medium · Not analysed yet · Published 18 Jul 2024 · Tags: Cross-site scripting (XSS)
- [Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via onclick events](https://agentprime.io/advisories/CVE-2024-3925.md)
  `CVE-2024-3925` · CVE record: bdthemes Element Pack – Widgets, Templates & Addons for Elementor · CVSS 6.4 Medium · Not analysed yet · Published 12 Jun 2024 · Tags: Cross-site scripting (XSS)
- [Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via custom_attributes](https://agentprime.io/advisories/CVE-2024-3926.md)
  `CVE-2024-3926` · CVE record: bdthemes Element Pack – Widgets, Templates & Addons for Elementor · CVSS 6.4 Medium · Not analysed yet · Published 22 May 2024 · Tags: Cross-site scripting (XSS)
- [Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.3 - Form Submission Admin Email Bypass](https://agentprime.io/advisories/CVE-2024-3927.md)
  `CVE-2024-3927` · CVE record: bdthemes Element Pack – Widgets, Templates & Addons for Elementor · CVSS 5.3 Medium · Not analysed yet · Published 22 May 2024 · Tags: CWE-424
- [Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.6.0 - Authenticated (Contributor+) Stored Cross-Site…](https://agentprime.io/advisories/CVE-2024-1429.md)
  `CVE-2024-1429` · CVE record: bdthemes Element Pack – Widgets, Templates & Addons for Elementor · CVSS 6.4 Medium · Not analysed yet · Published 18 Apr 2024 · Tags: Cross-site scripting (XSS)
- [Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.6.0 - Authenticated (Contributor+) Stored Cross-Site…](https://agentprime.io/advisories/CVE-2024-1426.md)
  `CVE-2024-1426` · CVE record: bdthemes Element Pack – Widgets, Templates & Addons for Elementor · CVSS 6.4 Medium · Not analysed yet · Published 18 Apr 2024 · Tags: Cross-site scripting (XSS)
- [Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.5.6 - Sensitive Information Exposure via element_pack_ajax_search](https://agentprime.io/advisories/CVE-2024-2966.md)
  `CVE-2024-2966` · CVE record: bdthemes Element Pack – Widgets, Templates & Addons for Elementor · CVSS 5.3 Medium · Not analysed yet · Published 11 Apr 2024 · Tags: Information disclosure
- [Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site…](https://agentprime.io/advisories/CVE-2024-0837.md)
  `CVE-2024-0837` · CVE record: bdthemes Element Pack – Widgets, Templates & Addons for Elementor · CVSS 6.4 Medium · Not analysed yet · Published 6 Apr 2024 · Tags: Cross-site scripting (XSS)
- [Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.5.3 - Authenticated (Contributor+) Stored Cross-Site…](https://agentprime.io/advisories/CVE-2024-1428.md)
  `CVE-2024-1428` · CVE record: bdthemes Element Pack – Widgets, Templates & Addons for Elementor · CVSS 6.4 Medium · Not analysed yet · Published 6 Apr 2024 · Tags: Cross-site scripting (XSS)

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=bdthemes-element-pack-widgets-templates-addons-for-elementor>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/bdthemes-element-pack-widgets-templates-addons-for-elementor/>. Everything for agents: <https://agentprime.io/llms.txt>.