Advisories · Technology

roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor.

Every CVE that names roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-4362 CVE record

CVSS 6.5 Medium

ElementsKit Elementor Addons <= 3.8.2 - Missing Authorization to Unauthenticated Widget Content Overwrite
- roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
- Broken access control
Not analysed yet 5 May 2026
CVE-2026-2600 CVE record

CVSS 6.4 Medium

ElementsKit Elementor Addons and Templates <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Simple Tab Widget
- roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
- Cross-site scripting (XSS)
Not analysed yet 4 Apr 2026
CVE-2026-23693 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

ElementsKit Elementor Addons < 3.7.9 Unauthenticated Mailchimp REST Endpoint
- Roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
- Authentication bypass
Not analysed yet 23 Feb 2026
CVE-2025-3614 CVE record

CVSS 6.4 Medium

ElementsKit Elementor Addons and Templates <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Widget
- roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
- Cross-site scripting (XSS)
Not analysed yet 24 Jul 2025
CVE-2025-4479 CVE record

CVSS 6.4 Medium

ElementsKit Lite <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison Widget
- roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
- Cross-site scripting (XSS)
Not analysed yet 19 Jun 2025
CVE-2024-11180 CVE record

CVSS 6.4 Medium

ElementsKit Elementor addons <= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
- Cross-site scripting (XSS)
Not analysed yet 29 Mar 2025
CVE-2025-0968 CVE record

CVSS 5.3 Medium

ElementsKit Elementor addons <= 3.4.0 - Unauthenticated Information Exposure via get_megamenu_content Function
- roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
- Broken access control
Not analysed yet 19 Feb 2025
CVE-2025-1005 CVE record

CVSS 6.4 Medium

ElementsKit Elementor addons <= 3.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion Widget
- roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
- Cross-site scripting (XSS)
Not analysed yet 15 Feb 2025
CVE-2024-10091 CVE record

CVSS 6.4 Medium

ElementsKit Elementor addons <= 3.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison Widget
- roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
- Cross-site scripting (XSS)
Not analysed yet 26 Oct 2024
CVE-2024-8546 CVE record

CVSS 6.4 Medium

ElementsKit Elementor addons <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Widget
- roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
- Cross-site scripting (XSS)
Not analysed yet 25 Sept 2024
CVE-2024-6455 CVE record

CVSS 5.3 Medium

ElementsKit Elementor addons <= 3.2.0 - Unauthenticated Information Exposure via ekit_widgetarea_content Function
- roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
- Information disclosure
Not analysed yet 18 Jul 2024
CVE-2024-3499 CVE record

CVSS 8.8 High

ElementsKit Elementor addons <= 3.1.0 - Authenticated (Contributor+) Local File Inclusion via Onepage Scroll Module
- roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
- File inclusion
Not analysed yet 2 May 2024
CVE-2024-2803 CVE record

CVSS 6.4 Medium

ElementsKit Elementor addons <= 3.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
- roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
- Cross-site scripting (XSS)
Not analysed yet 4 Apr 2024
CVE-2024-1238 CVE record

CVSS 6.4 Medium

ElementsKit Elementor addons <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
- Cross-site scripting (XSS)
Not analysed yet 30 Mar 2024
CVE-2024-2047 CVE record

CVSS 8.8 High

ElementsKit Elementor addons <= 3.0.6 - Authenticated (Contributor+) Local File Inclusion in render_raw
- roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
- File inclusion
Not analysed yet 30 Mar 2024
CVE-2023-6525 CVE record

CVSS 5.5 Medium

ElementsKit Elementor addons <= 3.0.3 - Authenticated(Editor+) Stored Cross-Site Scripting
- roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
- Cross-site scripting (XSS)
Not analysed yet 16 Mar 2024
CVE-2024-2042 CVE record

CVSS 6.4 Medium

ElementsKit Elementor addons <= 3.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion Widget
- roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
- Cross-site scripting (XSS)
Not analysed yet 16 Mar 2024
CVE-2024-1239 CVE record

CVSS 6.4 Medium

ElementsKit Elementor addons <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
- Cross-site scripting (XSS)
Not analysed yet 16 Mar 2024
CVE-2023-6582 CVE record

CVSS 5.3 Medium

ElementsKit Lite <= 3.0.3 - Unauthenticated Sensitive Information Exposure
- roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
- Broken access control
Not analysed yet 11 Jan 2024