Advisories · Technology

wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets.

Every CVE that names wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-118205 CVE record

CVSS 7.4 High

Essential Addons for Elementor <= 6.8.7 - Unauthenticated Privilege Escalation to 'page_id' Parameter via Elementor Revision
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Privilege escalation
Not analysed yet 30 Oct 2026
CVE-2026-15145 CVE record

CVSS 6.4 Medium

Essential Addons for Elementor <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Cross-site scripting (XSS)
Not analysed yet 21 Jul 2026
CVE-2026-15156 CVE record

CVSS 6.4 Medium

Essential Addons for Elementor <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Reading Progress Global Color Settings
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Cross-site scripting (XSS)
Not analysed yet 21 Jul 2026
CVE-2026-15155 CVE record

CVSS 8.8 High

Essential Addons for Elementor <= 6.6.10 - Authenticated (Contributor+) Account Takeover via Email Header Injection
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- CWE-640
Not analysed yet 11 Jul 2026
CVE-2026-6459 CVE record

CVSS 6.4 Medium

Essential Addons for Elementor <= 6.6.2 - Authenticated (Author+) Stored Cross-Site Scripting via Event Calendar Widget Popup
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Cross-site scripting (XSS)
Not analysed yet 8 Jul 2026
CVE-2026-7665 CVE record

CVSS 5.3 Medium

Essential Addons for Elementor <= 6.6.4 - Missing Authorization to Unauthenticated Information Exposure via 'load_more' AJAX Handler
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Broken access control
Not analysed yet 6 Jun 2026
CVE-2026-5193 CVE record

CVSS 6.5 Medium

Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.5.13 - Authenticated (Author+) Limited Privilege Escalation via register_user
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Privilege escalation
Not analysed yet 14 May 2026
CVE-2026-1512 CVE record

CVSS 6.4 Medium

Essential Addons for Elementor <= 6.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box Widget
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Cross-site scripting (XSS)
Not analysed yet 14 Feb 2026
CVE-2026-1004 CVE record

CVSS 5.3 Medium

Essential Addons for Elementor <= 6.5.5 - Missing Authorization to Unauthenticated Sensitive Information Exposure
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Broken access control
Not analysed yet 16 Jan 2026
CVE-2025-13977 CVE record

CVSS 6.4 Medium

Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Cross-site scripting (XSS)
Not analysed yet 17 Dec 2025
CVE-2025-8451 CVE record

CVSS 6.4 Medium

Essential Addons for Elementor – Popular Elementor Templates and Widgets <= 6.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'data-gallery-items'
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Cross-site scripting (XSS)
Not analysed yet 15 Aug 2025
CVE-2025-6244 CVE record

CVSS 6.4 Medium

Essential Addons for Elementor – Popular Elementor Templates and Widgets <= 6.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via `Calendar` And `Business Reviews` Widgets
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Cross-site scripting (XSS)
Not analysed yet 8 Jul 2025
CVE-2024-5647 CVE record

CVSS 6.4 Medium

Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library
- BlossomThemes Social Feed
- sayful Carousel Slider
- Cross-site scripting (XSS)
Not analysed yet 3 Jul 2025
CVE-2024-9993 CVE record

CVSS 6.4 Medium

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 6.1.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Event Calendar Widget
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Cross-site scripting (XSS)
Not analysed yet 7 Jun 2025
CVE-2024-9994 CVE record

CVSS 6.4 Medium

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 6.1.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Pricing Table Widget
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Cross-site scripting (XSS)
Not analysed yet 7 Jun 2025
CVE-2024-8978 CVE record

CVSS 5.7 Medium

Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.9 - Authenticated (Contributor+) Sensitive Information Exposure
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Information disclosure
Not analysed yet 15 Nov 2024
CVE-2024-8979 CVE record

CVSS 8.0 High

Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.9 - Authenticated (Author+) Sensitive Information Exposure to Privilege Escalation
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Information disclosure
Not analysed yet 15 Nov 2024
CVE-2024-8961 CVE record

CVSS 6.4 Medium

Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Cross-site scripting (XSS)
Not analysed yet 15 Nov 2024
CVE-2021-4447 CVE record

CVSS 8.8 High

Essential Addons for Elementor <= 4.6.4 - Authenticated (Contributor+) Privilege Escalation
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Broken access control
Not analysed yet 16 Oct 2024
CVE-2021-4446 CVE record

CVSS 6.3 Medium

Essential Addons for Elementor <= 4.6.4 - Missing Authorization
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Broken access control
Not analysed yet 16 Oct 2024
CVE-2024-8742 CVE record

CVSS 6.4 Medium

Essential Addons for Elementor <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery Widget
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Cross-site scripting (XSS)
Not analysed yet 13 Sept 2024
CVE-2024-8440 CVE record

CVSS 6.4 Medium

Essential Addons for Elementor -- Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Cross-site scripting (XSS)
Not analysed yet 11 Sept 2024
CVE-2024-7092 CVE record

CVSS 6.4 Medium

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via no_more_items_text Parameter
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Cross-site scripting (XSS)
Not analysed yet 13 Aug 2024
CVE-2024-5189 CVE record

CVSS 6.4 Medium

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.23 - Authenticated (Contributor+) Stored Cross-Site Scripting
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Cross-site scripting (XSS)
Not analysed yet 11 Jun 2024
CVE-2024-5188 CVE record

CVSS 6.4 Medium

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.22 - Authenticated (Contributor+) Stored Cross-Site Scripting
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Cross-site scripting (XSS)
Not analysed yet 6 Jun 2024
CVE-2024-5073 CVE record

CVSS 6.4 Medium

Essential Addons for Elementor <= 5.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Feed
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Cross-site scripting (XSS)
Not analysed yet 30 May 2024
CVE-2024-4624 CVE record

CVSS 6.4 Medium

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Cross-site scripting (XSS)
Not analysed yet 14 May 2024
CVE-2024-4275 CVE record

CVSS 6.4 Medium

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Interactive Circles'
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Cross-site scripting (XSS)
Not analysed yet 10 May 2024
CVE-2024-4449 CVE record

CVSS 6.4 Medium

Essential Addons for Elementor <= 5.9.19 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Several Widgets
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Cross-site scripting (XSS)
Not analysed yet 10 May 2024
CVE-2024-4448 CVE record

CVSS 6.4 Medium

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Dual Color Header', 'Event Ca…
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Cross-site scripting (XSS)
Not analysed yet 10 May 2024
CVE-2024-3728 CVE record

CVSS 6.4 Medium

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery & Interacti…
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Cross-site scripting (XSS)
Not analysed yet 2 May 2024
CVE-2024-4156 CVE record

CVSS 6.4 Medium

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.17 - Authenticated (Contributor+) Stored Cross-Site Scripting
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Cross-site scripting (XSS)
Not analysed yet 2 May 2024
CVE-2024-4003 CVE record

CVSS 6.4 Medium

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- CWE-20
Not analysed yet 2 May 2024
CVE-2024-3733 CVE record

CVSS 5.3 Medium

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Information Exposure
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Information disclosure
Not analysed yet 25 Apr 2024
CVE-2024-3333 CVE record

CVSS 6.4 Medium

Essential Addons for Elementor <= 5.9.14 - Authenticated (Contributor+) Store Cross-Site Scripting via Widget URL Attribute
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Cross-site scripting (XSS)
Not analysed yet 17 Apr 2024
CVE-2024-2623 CVE record

CVSS 6.4 Medium

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Cross-site scripting (XSS)
Not analysed yet 9 Apr 2024
CVE-2024-2974 CVE record

CVSS 5.3 Medium

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.13 - Unauthenticated Sensitive Information Exposure
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Information disclosure
Not analysed yet 9 Apr 2024
CVE-2024-2650 CVE record

CVSS 6.4 Medium

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- CWE-20
Not analysed yet 9 Apr 2024
CVE-2024-3018 CVE record

CVSS 8.8 High

Essential Addons for Elementor <= 5.9.13 - Authenticated (Author+) PHP Object Injection via error_resetpassword
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Insecure deserialization
Not analysed yet 30 Mar 2024
CVE-2024-1537 CVE record

CVSS 6.4 Medium

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Cross-site scripting (XSS)
Not analysed yet 13 Mar 2024
CVE-2024-1536 CVE record

CVSS 7.4 High

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Event Calendar
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Cross-site scripting (XSS)
Not analysed yet 13 Mar 2024
CVE-2024-1171 CVE record

CVSS 5.4 Medium

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Cross-site scripting (XSS)
Not analysed yet 20 Feb 2024
CVE-2024-1172 CVE record

CVSS 5.4 Medium

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Cross-site scripting (XSS)
Not analysed yet 20 Feb 2024
CVE-2024-1276 CVE record

CVSS 6.4 Medium

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Cross-site scripting (XSS)
Not analysed yet 20 Feb 2024
CVE-2024-1236 CVE record

CVSS 6.4 Medium

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Cross-site scripting (XSS)
Not analysed yet 20 Feb 2024
CVE-2024-0586 CVE record

CVSS 6.4 Medium

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.4 - Authenticated (Contributor+) Stored Cross-Site Scritping
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Cross-site scripting (XSS)
Not analysed yet 5 Feb 2024
CVE-2024-0954 CVE record

CVSS 6.4 Medium

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Cross-site scripting (XSS)
Not analysed yet 5 Feb 2024
CVE-2024-0585 CVE record

CVSS 5.4 Medium

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image URl
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Cross-site scripting (XSS)
Not analysed yet 5 Feb 2024
CVE-2023-7044 CVE record

CVSS 6.4 Medium

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Cross-site scripting (XSS)
Not analysed yet 4 Jan 2024
CVE-2023-3779 CVE record

CVSS 5.3 Medium

Essential Addons For Elementor <=5.8.1 - Unauthenticated MailChimp API Key Disclosure
- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Information disclosure
Not analysed yet 20 Jul 2023