Advisories · Technology

bdthemes Element Pack – Widgets, Templates & Addons for Elementor.

Every CVE that names bdthemes Element Pack – Widgets, Templates & Addons for Elementor among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-4655 CVE record

CVSS 6.4 Medium

Element Pack Addons for Elementor <= 8.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Image Widget
- bdthemes Element Pack – Widgets, Templates & Addons for Elementor
- Cross-site scripting (XSS)
Not analysed yet 8 Apr 2026
CVE-2026-1793 CVE record

CVSS 6.5 Medium

Element Pack Addons for Elementor <= 8.3.17 - Authenticated (Contributor+) Arbitrary File Read
- bdthemes Element Pack – Widgets, Templates & Addons for Elementor
- Path traversal
Not analysed yet 15 Feb 2026
CVE-2025-13196 CVE record

CVSS 5.4 Medium

Element Pack Addons for Elementor <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map widget
- bdthemes Element Pack – Widgets, Templates & Addons for Elementor
- Cross-site scripting (XSS)
Not analysed yet 18 Nov 2025
CVE-2025-11536 CVE record

CVSS 5.0 Medium

Element Pack Addons for Elementor <= 8.2.5 - Authenticated (Subscriber+) Blind Server-Side Request Forgery
- bdthemes Element Pack – Widgets, Templates & Addons for Elementor
- Server-side request forgery (SSRF)
Not analysed yet 20 Oct 2025
CVE-2025-8100 CVE record

CVSS 5.4 Medium

Element Pack Elementor Addons and Templates <= 8.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map Widget Marker Content
- bdthemes Element Pack – Widgets, Templates & Addons for Elementor
- Cross-site scripting (XSS)
Not analysed yet 6 Aug 2025
CVE-2025-5292 CVE record

CVSS 6.4 Medium

Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder <= 5.11.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
- bdthemes Element Pack – Widgets, Templates & Addons for Elementor
- Cross-site scripting (XSS)
Not analysed yet 31 May 2025
CVE-2025-1458 CVE record

CVSS 6.4 Medium

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.29 - Authenticated (Contributor+) Stored Cross-Site Scripting
- bdthemes Element Pack – Widgets, Templates & Addons for Elementor
- Cross-site scripting (XSS)
Not analysed yet 26 Apr 2025
CVE-2025-1457 CVE record

CVSS 6.4 Medium

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.28 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
- bdthemes Element Pack – Widgets, Templates & Addons for Elementor
- Cross-site scripting (XSS)
Not analysed yet 19 Apr 2025
CVE-2024-12851 CVE record

CVSS 6.4 Medium

Element Pack Lite - Addons for Elementor <= 5.10.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
- bdthemes Element Pack – Widgets, Templates & Addons for Elementor
- Cross-site scripting (XSS)
Not analysed yet 8 Jan 2025
CVE-2024-11852 CVE record

CVSS 4.3 Medium

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.12 - Missing Authorization
- bdthemes Element Pack – Widgets, Templates & Addons for Elementor
- Broken access control
Not analysed yet 22 Dec 2024
CVE-2024-9058 CVE record

CVSS 6.4 Medium

Element Pack Elementor Addons <= 5.10.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Lightbox Widget
- bdthemes Element Pack – Widgets, Templates & Addons for Elementor
- Cross-site scripting (XSS)
Not analysed yet 3 Dec 2024
CVE-2024-9867 CVE record

CVSS 5.4 Medium

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Map Widget
- bdthemes Element Pack – Widgets, Templates & Addons for Elementor
- Cross-site scripting (XSS)
Not analysed yet 5 Nov 2024
CVE-2024-9657 CVE record

CVSS 6.5 Medium

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
- bdthemes Element Pack – Widgets, Templates & Addons for Elementor
- Cross-site scripting (XSS)
Not analysed yet 5 Nov 2024
CVE-2024-9868 CVE record

CVSS 5.4 Medium

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Age Gate
- bdthemes Element Pack – Widgets, Templates & Addons for Elementor
- Cross-site scripting (XSS)
Not analysed yet 2 Nov 2024
CVE-2024-10310 CVE record

CVSS 6.4 Medium

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Custom Galle…
- bdthemes Element Pack – Widgets, Templates & Addons for Elementor
- Cross-site scripting (XSS)
Not analysed yet 2 Nov 2024
CVE-2024-7247 CVE record

CVSS 6.4 Medium

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Gallery and Coun…
- bdthemes Element Pack – Widgets, Templates & Addons for Elementor
- Cross-site scripting (XSS)
Not analysed yet 13 Aug 2024
CVE-2024-4359 CVE record

CVSS 6.5 Medium

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.2 - Authenticated (Contributor+) Arbitrary File Read
- bdthemes Element Pack – Widgets, Templates & Addons for Elementor
- File inclusion
Not analysed yet 9 Aug 2024
CVE-2024-4360 CVE record

CVSS 6.4 Medium

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag
- bdthemes Element Pack – Widgets, Templates & Addons for Elementor
- Cross-site scripting (XSS)
Not analysed yet 9 Aug 2024
CVE-2024-4643 CVE record

CVSS 6.4 Medium

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
- bdthemes Element Pack – Widgets, Templates & Addons for Elementor
- Cross-site scripting (XSS)
Not analysed yet 2 Aug 2024
CVE-2024-5555 CVE record

CVSS 6.4 Medium

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- bdthemes Element Pack – Widgets, Templates & Addons for Elementor
- Cross-site scripting (XSS)
Not analysed yet 18 Jul 2024
CVE-2024-5554 CVE record

CVSS 6.4 Medium

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
- bdthemes Element Pack – Widgets, Templates & Addons for Elementor
- Cross-site scripting (XSS)
Not analysed yet 18 Jul 2024
CVE-2024-3925 CVE record

CVSS 6.4 Medium

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via onclick events
- bdthemes Element Pack – Widgets, Templates & Addons for Elementor
- Cross-site scripting (XSS)
Not analysed yet 12 Jun 2024
CVE-2024-3926 CVE record

CVSS 6.4 Medium

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via custom_attributes
- bdthemes Element Pack – Widgets, Templates & Addons for Elementor
- Cross-site scripting (XSS)
Not analysed yet 22 May 2024
CVE-2024-3927 CVE record

CVSS 5.3 Medium

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.3 - Form Submission Admin Email Bypass
- bdthemes Element Pack – Widgets, Templates & Addons for Elementor
- CWE-424
Not analysed yet 22 May 2024
CVE-2024-1429 CVE record

CVSS 6.4 Medium

Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.6.0 - Authenticated (Contributor+) Stored Cross-Site…
- bdthemes Element Pack – Widgets, Templates & Addons for Elementor
- Cross-site scripting (XSS)
Not analysed yet 18 Apr 2024
CVE-2024-1426 CVE record

CVSS 6.4 Medium

Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.6.0 - Authenticated (Contributor+) Stored Cross-Site…
- bdthemes Element Pack – Widgets, Templates & Addons for Elementor
- Cross-site scripting (XSS)
Not analysed yet 18 Apr 2024
CVE-2024-2966 CVE record

CVSS 5.3 Medium

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.5.6 - Sensitive Information Exposure via element_pack_ajax_search
- bdthemes Element Pack – Widgets, Templates & Addons for Elementor
- Information disclosure
Not analysed yet 11 Apr 2024
CVE-2024-0837 CVE record

CVSS 6.4 Medium

Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site…
- bdthemes Element Pack – Widgets, Templates & Addons for Elementor
- Cross-site scripting (XSS)
Not analysed yet 6 Apr 2024
CVE-2024-1428 CVE record

CVSS 6.4 Medium

Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.5.3 - Authenticated (Contributor+) Stored Cross-Site…
- bdthemes Element Pack – Widgets, Templates & Addons for Elementor
- Cross-site scripting (XSS)
Not analysed yet 6 Apr 2024