Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce — Vulnerabilities & Security Advisories 29

All 29 CVE vulnerabilities found in The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities associated with the vendor The Plus Addons for Elementor, specifically covering their suite of WordPress plugins including Addons for Elementor, Page Templates, Widgets, Mega Menu, and WooCommerce. The collection encompasses a wide spectrum of reported weaknesses ranging from cross-site scripting and SQL injection to unauthorized file access and privilege escalation, spanning the period from the initial public disclosure of these issues through the most recent updates. Users visiting this resource can track the vendor's official security advisories to monitor patch releases, analyze the prevalence of specific weakness classes within the Elementor ecosystem, or review the complete historical vulnerability record for any individual product in this suite. By centralizing these disparate reports, the page provides a clear view of the security posture for these popular WordPress extensions without requiring users to search multiple databases or forums. This consolidated data assists developers and site administrators in making informed decisions about plugin usage, prioritizing necessary updates, and implementing robust defense strategies against known exploits affecting their WordPress installations. The information presented here is derived from public advisories and security bulletins to ensure accuracy and timeliness for all listed components.

Vendor: posimyththemes

CVE ID Title CVSS Severity Published
CVE-2026-15285 The Plus Addons for Elementor <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes CWE-79 6.4 Medium 2026-07-10
CVE-2026-9243 The Plus Addons for Elementor <= 6.4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'carousel_direction' Parameter CWE-79 6.4 Medium 2026-05-29
CVE-2026-5243 The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Lite Widget CWE-79 6.4 Medium 2026-05-14
CVE-2026-3311 The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar CWE-79 6.4 Medium 2026-04-08
CVE-2026-2385 The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Unauthenticated Email Relay CWE-345 5.3 Medium 2026-02-22
CVE-2026-2386 The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Incorrect Authorization to Authenticated (Author+) Arbitrary Draft Post Creation via 'post_type' CWE-863 4.3 Medium 2026-02-18
CVE-2025-7646 The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting CWE-79 6.4 Medium 2025-08-01
CVE-2025-1287 The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets CWE-79 6.4 Medium 2025-03-08
CVE-2024-11829 The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting CWE-79 6.4 Medium 2025-02-01
CVE-2024-10365 The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.0.3 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates CWE-200 4.3 Medium 2024-11-20
CVE-2024-8913 The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.11 - Authenticated (Contributor+) Sensitive Information Exposure via content_template CWE-200 4.3 Medium 2024-10-11
CVE-2024-5583 The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonials Widget Settings CWE-79 6.4 Medium 2024-08-22
CVE-2024-5763 The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Widget CWE-79 6.4 Medium 2024-08-20
CVE-2024-6575 The Plus Addons for Elementor <= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via TP Page Scroll Widget CWE-79 6.4 Medium 2024-08-20
CVE-2024-4482 The Plus Addons for Elementor <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget CWE-79 6.4 Medium 2024-07-03
CVE-2024-4983 The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.0- Authenticated (Contributor+) Stored Cross-Site Scripting CWE-79 6.4 Medium 2024-06-27
CVE-2024-4484 The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CWE-79 6.4 Medium 2024-05-24
CVE-2024-4485 The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CWE-79 6.4 Medium 2024-05-24
CVE-2024-3718 The Plus Addons for Elementor <= 5.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar, Header Meta Content, Scroll Navigation, Pricing Table, & Flip Box CWE-79 6.4 Medium 2024-05-24
CVE-2024-2784 The Plus Addons for Elementor <= 5.5.4 - Authenticated (Contibutor+) Stored Cross-Site Scripting via Hover Card CWE-79 6.4 Medium 2024-05-24
CVE-2024-2785 The Plus Addons for Elementor <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Age Gate CWE-79 6.4 Medium 2024-05-09
CVE-2024-0445 The Plus Addons for Elementor <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CWE-79 6.4 Medium 2024-05-09
CVE-2024-3197 The Plus Addons for Elementor <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes CWE-79 6.4 Medium 2024-05-02
CVE-2024-3199 The Plus Addons for Elementor <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget CWE-79 6.4 Medium 2024-05-02
CVE-2024-2203 The Plus Addons for Elementor <= 5.4.1 - Authenticated (Contributor+) Local File Inclusion via Clients Widget CWE-22 6.4 Medium 2024-03-27
CVE-2024-2210 The Plus Addons for Elementor <= 5.4.1 - Authenticated (Contributor+) Local File Inclusion via Team Member Listing CWE-22 6.4 Medium 2024-03-27
CVE-2024-1419 The Plus Addons for Elementor <= 5.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Header Meta Content Widget CWE-79 6.4 Medium 2024-03-07
CVE-2021-4332 The Plus Addons for Elementor PRO <= 4.1.9 & The Plus Addons for Elementor <= 2.0.6 - Authenticated (Contributor+) Arbitrary File Read CWE-73 6.5 Medium 2023-03-07
CVE-2021-4331 The Plus Addons for Elementor PRO <= 4.1.9 & The Plus Addons for Elementor <= 2.0.6 - Authenticated (Contributor+) Privilege Escalation CWE-862 8.8 High 2023-03-07

All 29 known CVE vulnerabilities affecting The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce with full Chinese analysis, references, and POCs where available.