Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

Essential Addons for Elementor – Popular Elementor Templates & Widgets — Vulnerabilities & Security Advisories 48

All 48 CVE vulnerabilities found in Essential Addons for Elementor – Popular Elementor Templates & Widgets, with AI-generated Chinese analysis, references, and POCs.

This page documents security weaknesses associated with the Essential Addons for Elementor plugin, specifically focusing on vulnerabilities within its popular Elementor templates and widgets ecosystem. It aggregates known security issues, including remote code execution, privilege escalation, and information disclosure flaws, covering reported incidents from early 2021 through the present. This collection serves as a centralized resource for developers, security auditors, and site administrators to review the historical security posture of this widely used WordPress extension. By compiling data from official vendor advisories, third-party security databases, and community reports, the page provides a comprehensive timeline of disclosed defects. Users can track how the vendor responds to emerging threats, analyze patterns in specific weakness classes such as Cross-Site Scripting or improper input validation, and examine the evolution of security fixes for individual components. This information is critical for assessing risk levels and prioritizing updates in environments relying on this tool. Understanding the frequency and severity of past incidents helps in evaluating the robustness of the codebase and the effectiveness of the maintenance team. Readers can use this data to make informed decisions about whether to continue using the plugin, implement specific mitigations, or seek alternative solutions. The aggregated view highlights both critical and low-severity issues, offering a balanced perspective on the product’s security history. This transparency supports better decision-making for site owners concerned with compliance and protection against known exploitation vectors. Ultimately, the page aims to reduce uncertainty by providing clear, accessible records of all publicly disclosed vulnerabilities linked to the software.

Vendor: wpdevteam

CVE IDTitleCVSSSeverityPublished
CVE-2026-15145 Essential Addons for Elementor <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget CWE-79 6.4 Medium2026-07-21
CVE-2026-15156 Essential Addons for Elementor <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Reading Progress Global Color Settings CWE-79 6.4 Medium2026-07-21
CVE-2026-15155 Essential Addons for Elementor <= 6.6.10 - Authenticated (Contributor+) Account Takeover via Email Header Injection CWE-640 8.8 High2026-07-11
CVE-2026-6459 Essential Addons for Elementor <= 6.6.2 - Authenticated (Author+) Stored Cross-Site Scripting via Event Calendar Widget Popup CWE-79 6.4 Medium2026-07-08
CVE-2026-7665 Essential Addons for Elementor <= 6.6.4 - Missing Authorization to Unauthenticated Information Exposure via 'load_more' AJAX Handler CWE-639 5.3 Medium2026-06-06
CVE-2026-5193 Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.5.13 - Authenticated (Author+) Limited Privilege Escalation via register_user CWE-269 6.5 Medium2026-05-14
CVE-2026-1512 Essential Addons for Elementor <= 6.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box Widget CWE-79 6.4 Medium2026-02-14
CVE-2026-1004 Essential Addons for Elementor <= 6.5.5 - Missing Authorization to Unauthenticated Sensitive Information Exposure CWE-862 5.3 Medium2026-01-16
CVE-2025-13977 Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting CWE-79 6.4 Medium2025-12-17
CVE-2025-8451 Essential Addons for Elementor – Popular Elementor Templates and Widgets <= 6.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'data-gallery-items' CWE-79 6.4 Medium2025-08-15
CVE-2025-6244 Essential Addons for Elementor – Popular Elementor Templates and Widgets <= 6.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via `Calendar` And `Business Reviews` Widgets CWE-79 6.4 Medium2025-07-08
CVE-2024-9993 Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 6.1.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Event Calendar Widget CWE-79 6.4 Medium2025-06-07
CVE-2024-9994 Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 6.1.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Pricing Table Widget CWE-79 6.4 Medium2025-06-07
CVE-2024-8978 Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.9 - Authenticated (Contributor+) Sensitive Information Exposure CWE-200 5.7 Medium2024-11-15
CVE-2024-8979 Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.9 - Authenticated (Author+) Sensitive Information Exposure to Privilege Escalation CWE-200 8.0 High2024-11-15
CVE-2024-8961 Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting CWE-79 6.4 Medium2024-11-15
CVE-2021-4447 Essential Addons for Elementor <= 4.6.4 - Authenticated (Contributor+) Privilege Escalation CWE-862 8.8 High2024-10-16
CVE-2021-4446 Essential Addons for Elementor <= 4.6.4 - Missing Authorization CWE-862 6.3 Medium2024-10-16
CVE-2024-8742 Essential Addons for Elementor <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery Widget CWE-79 6.4 Medium2024-09-13
CVE-2024-8440 Essential Addons for Elementor -- Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget CWE-79 6.4 Medium2024-09-11
CVE-2024-7092 Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via no_more_items_text Parameter CWE-79 6.4 Medium2024-08-13
CVE-2024-5189 Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.23 - Authenticated (Contributor+) Stored Cross-Site Scripting CWE-79 6.4 Medium2024-06-11
CVE-2024-5188 Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.22 - Authenticated (Contributor+) Stored Cross-Site Scripting CWE-79 6.4 Medium2024-06-06
CVE-2024-5073 Essential Addons for Elementor <= 5.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Feed CWE-79 6.4 Medium2024-05-30
CVE-2024-4624 Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.20 - Authenticated (Contributor+) Stored Cross-Site Scripting CWE-79 6.4 Medium2024-05-14
CVE-2024-4275 Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Interactive Circles' CWE-79 6.4 Medium2024-05-10
CVE-2024-4449 Essential Addons for Elementor <= 5.9.19 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Several Widgets CWE-79 6.4 Medium2024-05-10
CVE-2024-4448 Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Dual Color Header', 'Event Calendar', & 'Advanced Data Table' CWE-79 6.4 Medium2024-05-10
CVE-2024-3728 Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery & Interactive Circle CWE-79 6.4 Medium2024-05-02
CVE-2024-4156 Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.17 - Authenticated (Contributor+) Stored Cross-Site Scripting CWE-79 6.4 Medium2024-05-02

All 48 known CVE vulnerabilities affecting Essential Addons for Elementor – Popular Elementor Templates & Widgets with full Chinese analysis, references, and POCs where available.