EN ES
Start free
Menu

Essential Addons for Elementor: known security problems

74 known security problems reported for this WordPress plugin, with the affected versions, the fix and what to do.

Updated

In short

There are 74 known security problems on this page. Each one has a fixed version. Updating to version 6.8.8 or newer covers every fixed problem listed here.

Based on public reports. Check the plugin’s changelog. Watchfox AI may be wrong.

Get an email when your site is affected: install Watchfox AI (free)

This week

A stranger could take over your site as an admin (up to and including 6.8.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 6.8.7
Fixed in
6.8.8
What to do
If your site has an affected version, update Essential Addons for Elementor to version 6.8.8 or newer.
Official ID
CVE-2026-118205
Report title
Essential Addons for Elementor <= 6.8.7 - Unauthenticated Privilege Escalation to 'page_id' Parameter via Elementor Revision
First reported
Sources
This week

A stranger could use it to harm your site (before 6.8.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 6.8.7
Fixed in
6.8.7
What to do
If your site has an affected version, update Essential Addons for Elementor to version 6.8.7 or newer.
Official ID
CVE-2026-110509
Report title
Essential Addons for Elementor – Popular Elementor Templates & Widgets < 6.8.7 - Unauthenticated Information Exposure
First reported
Sources
This week

Someone with an author account on your site could plant harmful code that runs for your visitors or admins (before 6.8.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 6.8.7
Fixed in
6.8.7
What to do
If your site has an affected version, update Essential Addons for Elementor to version 6.8.7 or newer.
Official ID
CVE-2026-110510
Report title
Essential Addons for Elementor – Popular Elementor Templates & Widgets < 6.8.7 - Authenticated (Author+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (before 6.8.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 6.8.7
Fixed in
6.8.7
What to do
If your site has an affected version, update Essential Addons for Elementor to version 6.8.7 or newer.
Official ID
CVE-2026-110537
Report title
Essential Addons for Elementor – Popular Elementor Templates & Widgets < 6.8.7 - Missing Authorization
First reported
Sources
This week

Someone with an author account on your site could take over your site as an admin (up to and including 6.8.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 6.8.5
Fixed in
6.8.6
What to do
If your site has an affected version, update Essential Addons for Elementor to version 6.8.6 or newer.
Official ID
CVE-2026-110898
Report title
Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.8.5 - Authenticated (Author+) Privilege Escalation
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 6.8.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 6.8.4
Fixed in
6.8.5
What to do
If your site has an affected version, update Essential Addons for Elementor to version 6.8.5 or newer.
Official ID
CVE-2026-102394
Report title
Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 6.8.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 6.8.0
Fixed in
6.8.1
What to do
If your site has an affected version, update Essential Addons for Elementor to version 6.8.1 or newer.
Official ID
CVE-2026-81777
Report title
Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.8.0 - Unauthenticated Captcha Bypass
First reported
Sources
This week

A stranger could take over your site as an admin (up to and including 6.7.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 6.7.1
Fixed in
6.7.2
What to do
If your site has an affected version, update Essential Addons for Elementor to version 6.7.2 or newer.
Official ID
CVE-2026-18039
Report title
Essential Addons for Elementor <= 6.7.1 - Unauthenticated Privilege Escalation
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (before 6.6.10)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 6.6.10
Fixed in
6.6.10
What to do
If your site has an affected version, update Essential Addons for Elementor to version 6.6.10 or newer.
Official ID
CVE-2026-13345
Report title
Essential Addons for Elementor – Popular Elementor Templates & Widgets < 6.6.10 - Missing Authorization
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (before 6.6.10)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 6.6.10
Fixed in
6.6.10
What to do
If your site has an affected version, update Essential Addons for Elementor to version 6.6.10 or newer.
Official ID
CVE-2026-13344
Report title
Essential Addons for Elementor – Popular Elementor Templates & Widgets < 6.6.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 6.6.11)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 6.6.11
Fixed in
6.7.0
What to do
If your site has an affected version, update Essential Addons for Elementor to version 6.7.0 or newer.
Official ID
CVE-2026-15145
Report title
Essential Addons for Elementor <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 6.6.11) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 6.6.11
Fixed in
6.7.0
What to do
If your site has an affected version, update Essential Addons for Elementor to version 6.7.0 or newer.
Official ID
CVE-2026-15156
Report title
Essential Addons for Elementor <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Reading Progress Global Color Settings
First reported
Sources
This week

Someone with a contributor account on your site could take over your site as an admin (up to and including 6.6.10)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 6.6.10
Fixed in
6.6.11
What to do
If your site has an affected version, update Essential Addons for Elementor to version 6.6.11 or newer.
Official ID
CVE-2026-15155
Report title
Essential Addons for Elementor <= 6.6.10 - Authenticated (Contributor+) Account Takeover via Email Header Injection
First reported
Sources
This week

Someone with an author account on your site could plant harmful code that runs for your visitors or admins (up to and including 6.6.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 6.6.2
Fixed in
6.6.3
What to do
If your site has an affected version, update Essential Addons for Elementor to version 6.6.3 or newer.
Official ID
CVE-2026-6459
Report title
Essential Addons for Elementor <= 6.6.2 - Authenticated (Author+) Stored Cross-Site Scripting via Event Calendar Widget Popup
First reported
Sources
This week

A stranger could do things on your site they should not be allowed to

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 6.6.4
Fixed in
6.6.5
What to do
If your site has an affected version, update Essential Addons for Elementor to version 6.6.5 or newer.
Official ID
CVE-2026-7665
Report title
Essential Addons for Elementor <= 6.6.4 - Missing Authorization to Unauthenticated Information Exposure via 'load_more' AJAX Handler
First reported
Sources
This week

Someone with an author account on your site could take over your site as an admin (up to and including 6.5.13)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 6.5.13
Fixed in
6.6.0
What to do
If your site has an affected version, update Essential Addons for Elementor to version 6.6.0 or newer.
Official ID
CVE-2026-5193
Report title
Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.5.13 - Authenticated (Author+) Limited Privilege Escalation via register_user
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (before 6.6.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 6.6.0
Fixed in
6.6.0
What to do
If your site has an affected version, update Essential Addons for Elementor to version 6.6.0 or newer.
Official ID
CVE-2026-25440
Report title
Essential Addons for Elementor – Popular Elementor Templates & Widgets < 6.6.0 - Missing Authorization
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 6.5.9)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 6.5.9
Fixed in
6.5.10
What to do
If your site has an affected version, update Essential Addons for Elementor to version 6.5.10 or newer.
Official ID
CVE-2026-1512
Report title
Essential Addons for Elementor <= 6.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box Widget
First reported
Sources
This week

A stranger could see private information they should not see (up to and including 6.5.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 6.5.5
Fixed in
6.5.6
What to do
If your site has an affected version, update Essential Addons for Elementor to version 6.5.6 or newer.
Official ID
CVE-2026-1004
Report title
Essential Addons for Elementor <= 6.5.5 - Missing Authorization to Unauthenticated Sensitive Information Exposure
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 6.5.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 6.5.3
Fixed in
6.5.4
What to do
If your site has an affected version, update Essential Addons for Elementor to version 6.5.4 or newer.
Official ID
CVE-2025-69092
Report title
Essential Addons for Elementor <= 6.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 6.5.3) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 6.5.3
Fixed in
6.5.4
What to do
If your site has an affected version, update Essential Addons for Elementor to version 6.5.4 or newer.
Official ID
CVE-2025-13977
Report title
Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 6.5.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 6.5.5
Fixed in
6.5.6
What to do
If your site has an affected version, update Essential Addons for Elementor to version 6.5.6 or newer.
Official ID
CVE-2026-23543
Report title
Essential Addons for Elementor <= 6.5.5 - Missing Authorization
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 6.2.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 6.2.4
Fixed in
6.3.0
What to do
If your site has an affected version, update Essential Addons for Elementor to version 6.3.0 or newer.
Official ID
CVE-2025-64352
Report title
Essential Addons for Elementor <= 6.2.4 - Missing Authorization
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 6.2.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 6.2.2
Fixed in
6.2.3
What to do
If your site has an affected version, update Essential Addons for Elementor to version 6.2.3 or newer.
Official ID
CVE-2025-8451
Report title
Essential Addons for Elementor – Popular Elementor Templates and Widgets <= 6.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'data-gallery-items'
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 6.1.19)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 6.1.19
Fixed in
6.1.20
What to do
If your site has an affected version, update Essential Addons for Elementor to version 6.1.20 or newer.
Official ID
CVE-2025-6244
Report title
Essential Addons for Elementor – Popular Elementor Templates and Widgets <= 6.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via `Calendar` And `Business Reviews` Widgets
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 6.0.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 6.0.4
Fixed in
6.0.5
What to do
If your site has an affected version, update Essential Addons for Elementor to version 6.0.5 or newer.
Official ID
CVE-2024-5647
Report title
Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 6.1.12)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 6.1.12
Fixed in
6.1.13
What to do
If your site has an affected version, update Essential Addons for Elementor to version 6.1.13 or newer.
Official ID
CVE-2024-9993
Report title
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 6.1.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Event Calendar Widget
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 6.1.12) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 6.1.12
Fixed in
6.1.13
What to do
If your site has an affected version, update Essential Addons for Elementor to version 6.1.13 or newer.
Official ID
CVE-2024-9994
Report title
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 6.1.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Pricing Table Widget
First reported
Sources
This week

Someone with a contributor account on your site could use it to harm your site (up to and including 6.1.9)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 6.1.9
Fixed in
6.1.10
What to do
If your site has an affected version, update Essential Addons for Elementor to version 6.1.10 or newer.
Official ID
CVE-2025-39589
Report title
Essential Addons for Elementor <= 6.1.9 - Authenticated (Contributor+) Information Disclosure
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 6.1.9)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 6.1.9
Fixed in
6.1.10
What to do
If your site has an affected version, update Essential Addons for Elementor to version 6.1.10 or newer.
Official ID
CVE-2025-39590
Report title
Essential Addons for Elementor <= 6.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 6.0.14)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 6.0.14
Fixed in
6.0.15
What to do
If your site has an affected version, update Essential Addons for Elementor to version 6.0.15 or newer.
Official ID
CVE-2025-24752
Report title
Essential Addons for Elementor <= 6.0.14 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 6.0.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 6.0.7
Fixed in
6.0.8
What to do
If your site has an affected version, update Essential Addons for Elementor to version 6.0.8 or newer.
Official ID
CVE-2024-56063
Report title
Essential Addons for Elementor <= 6.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 6.0.7) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 6.0.7
Fixed in
6.0.8
What to do
If your site has an affected version, update Essential Addons for Elementor to version 6.0.8 or newer.
Official ID
CVE-2024-8961
Report title
Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with an author account on your site could take over your site as an admin (up to and including 6.0.9)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 6.0.9
Fixed in
6.0.10
What to do
If your site has an affected version, update Essential Addons for Elementor to version 6.0.10 or newer.
Official ID
CVE-2024-8979
Report title
Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.9 - Authenticated (Author+) Sensitive Information Exposure to Privilege Escalation
First reported
Sources
This week

Someone with a contributor account on your site could see private information they should not see

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 6.0.9
Fixed in
6.0.10
What to do
If your site has an affected version, update Essential Addons for Elementor to version 6.0.10 or newer.
Official ID
CVE-2024-8978
Report title
Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.9 - Authenticated (Contributor+) Sensitive Information Exposure
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 6.0.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 6.0.3
Fixed in
6.0.4
What to do
If your site has an affected version, update Essential Addons for Elementor to version 6.0.4 or newer.
Official ID
CVE-2024-8742
Report title
Essential Addons for Elementor <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery Widget
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 6.0.3) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 6.0.3
Fixed in
6.0.4
What to do
If your site has an affected version, update Essential Addons for Elementor to version 6.0.4 or newer.
Official ID
CVE-2024-8440
Report title
Essential Addons for Elementor -- Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 5.9.27)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 5.9.27
Fixed in
6.0.0
What to do
If your site has an affected version, update Essential Addons for Elementor to version 6.0.0 or newer.
Official ID
CVE-2024-7092
Report title
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via no_more_items_text Parameter
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 5.9.26)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 5.9.26
Fixed in
5.9.27
What to do
If your site has an affected version, update Essential Addons for Elementor to version 5.9.27 or newer.
Official ID
CVE-2024-39649
Report title
Essential Addons for Elementor <= 5.9.26 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 5.9.23)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 5.9.23
Fixed in
5.9.24
What to do
If your site has an affected version, update Essential Addons for Elementor to version 5.9.24 or newer.
Official ID
CVE-2024-5189
Report title
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.23 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 5.9.22)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 5.9.22
Fixed in
5.9.23
What to do
If your site has an affected version, update Essential Addons for Elementor to version 5.9.23 or newer.
Official ID
CVE-2024-5188
Report title
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.22 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 5.9.21)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 5.9.21
Fixed in
5.9.22
What to do
If your site has an affected version, update Essential Addons for Elementor to version 5.9.22 or newer.
Official ID
CVE-2024-5073
Report title
Essential Addons for Elementor <= 5.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Feed
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 5.9.15)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 5.9.15
Fixed in
5.9.16
What to do
If your site has an affected version, update Essential Addons for Elementor to version 5.9.16 or newer.
Official ID
CVE-2024-34764
Report title
Essential Addons for Elementor <= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 5.9.20)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 5.9.20
Fixed in
5.9.21
What to do
If your site has an affected version, update Essential Addons for Elementor to version 5.9.21 or newer.
Official ID
CVE-2024-4624
Report title
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 5.9.19)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 5.9.19
Fixed in
5.9.20
What to do
If your site has an affected version, update Essential Addons for Elementor to version 5.9.20 or newer.
Official ID
CVE-2024-4448
Report title
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Dual Color Header', 'Event Calendar', & 'Advanced Data Table'
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 5.9.19) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 5.9.19
Fixed in
5.9.20
What to do
If your site has an affected version, update Essential Addons for Elementor to version 5.9.20 or newer.
Official ID
CVE-2024-4275
Report title
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Interactive Circles'
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 5.9.19) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 5.9.19
Fixed in
5.9.20
What to do
If your site has an affected version, update Essential Addons for Elementor to version 5.9.20 or newer.
Official ID
CVE-2024-4449
Report title
Essential Addons for Elementor <= 5.9.19 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Several Widgets
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 5.9.17)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 5.9.17
Fixed in
5.9.18
What to do
If your site has an affected version, update Essential Addons for Elementor to version 5.9.18 or newer.
Official ID
CVE-2024-4156
Report title
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.17 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 5.9.15) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 5.9.15
Fixed in
5.9.16
What to do
If your site has an affected version, update Essential Addons for Elementor to version 5.9.16 or newer.
Official ID
CVE-2024-4003
Report title
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 5.9.15) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 5.9.15
Fixed in
5.9.16
What to do
If your site has an affected version, update Essential Addons for Elementor to version 5.9.16 or newer.
Official ID
CVE-2024-3728
Report title
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery & Interactive Circle
First reported
Sources
This week

Someone could use it to harm your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 5.9.15
Fixed in
5.9.16
What to do
If your site has an affected version, update Essential Addons for Elementor to version 5.9.16 or newer.
Official ID
CVE-2024-3733
Report title
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Information Exposure
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 5.9.14)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 5.9.14
Fixed in
5.9.15
What to do
If your site has an affected version, update Essential Addons for Elementor to version 5.9.15 or newer.
Official ID
CVE-2024-3333
Report title
Essential Addons for Elementor <= 5.9.14 - Authenticated (Contributor+) Store Cross-Site Scripting via Widget URL Attribute
First reported
Sources
This week

Someone with an author account on your site could in some setups, take over your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 5.9.13
Fixed in
5.9.14
What to do
If your site has an affected version, update Essential Addons for Elementor to version 5.9.14 or newer.
Official ID
CVE-2024-3018
Report title
Essential Addons for Elementor <= 5.9.13 - Authenticated (Author+) PHP Object Injection via error_resetpassword
First reported
Sources
This week

A stranger could see private information they should not see (up to and including 5.9.13)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 5.9.13
Fixed in
5.9.14
What to do
If your site has an affected version, update Essential Addons for Elementor to version 5.9.14 or newer.
Official ID
CVE-2024-2974
Report title
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.13 - Unauthenticated Sensitive Information Exposure
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 5.9.11)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 5.9.11
Fixed in
5.9.12
What to do
If your site has an affected version, update Essential Addons for Elementor to version 5.9.12 or newer.
Official ID
CVE-2024-2650
Report title
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 5.9.11) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 5.9.11
Fixed in
5.9.12
What to do
If your site has an affected version, update Essential Addons for Elementor to version 5.9.12 or newer.
Official ID
CVE-2024-2623
Report title
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 5.9.9)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 5.9.9
Fixed in
5.9.10
What to do
If your site has an affected version, update Essential Addons for Elementor to version 5.9.10 or newer.
Official ID
CVE-2024-1536
Report title
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Event Calendar
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 5.9.9) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 5.9.9
Fixed in
5.9.10
What to do
If your site has an affected version, update Essential Addons for Elementor to version 5.9.10 or newer.
Official ID
CVE-2024-1537
Report title
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 5.9.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 5.9.8
Fixed in
5.9.9
What to do
If your site has an affected version, update Essential Addons for Elementor to version 5.9.9 or newer.
Official ID
CVE-2024-1236
Report title
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 5.9.8) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 5.9.8
Fixed in
5.9.9
What to do
If your site has an affected version, update Essential Addons for Elementor to version 5.9.9 or newer.
Official ID
CVE-2024-1276
Report title
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 5.9.8) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 5.9.8
Fixed in
5.9.9
What to do
If your site has an affected version, update Essential Addons for Elementor to version 5.9.9 or newer.
Official ID
CVE-2024-1172
Report title
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 5.9.8) (4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 5.9.8
Fixed in
5.9.9
What to do
If your site has an affected version, update Essential Addons for Elementor to version 5.9.9 or newer.
Official ID
CVE-2024-1171
Report title
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 5.9.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 5.9.7
Fixed in
5.9.8
What to do
If your site has an affected version, update Essential Addons for Elementor to version 5.9.8 or newer.
Official ID
CVE-2024-0954
Report title
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 5.9.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 5.9.4
Fixed in
5.9.5
What to do
If your site has an affected version, update Essential Addons for Elementor to version 5.9.5 or newer.
Official ID
CVE-2024-0585
Report title
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image URl
First reported
Sources
This week

Someone with a contributor account on your site could use it to harm your site (up to and including 5.9.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 5.9.4
Fixed in
5.9.5
What to do
If your site has an affected version, update Essential Addons for Elementor to version 5.9.5 or newer.
Official ID
CVE-2024-0586
Report title
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.4 - Authenticated (Contributor+) Stored Cross-Site Scritping
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 5.9.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 5.9.2
Fixed in
5.9.3
What to do
If your site has an affected version, update Essential Addons for Elementor to version 5.9.3 or newer.
Official ID
CVE-2023-7044
Report title
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could take over your site as an admin (up to and including 5.8.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 5.8.8
Fixed in
5.8.9
What to do
If your site has an affected version, update Essential Addons for Elementor to version 5.8.9 or newer.
Official ID
CVE-2023-41955
Report title
Essential Addons for Elementor <= 5.8.8 - Authenticated (Contributor+) Privilege Escalation
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 5.8.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 5.8.1
Fixed in
5.8.2
What to do
If your site has an affected version, update Essential Addons for Elementor to version 5.8.2 or newer.
Official ID
CVE-2023-3779
Report title
Essential Addons For Elementor <=5.8.1 - Unauthenticated MailChimp API Key Disclosure
First reported
Sources
This week

A stranger could take over your site as an admin (up to and including 5.7.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 5.7.1
Fixed in
5.7.2
What to do
If your site has an affected version, update Essential Addons for Elementor to version 5.7.2 or newer.
Official ID
CVE-2023-32243
Report title
Essential Addons for Elementor <= 5.7.1 - Unauthenticated Arbitrary Password Reset to Privilege Escalation
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 5.0.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 5.0.8
Fixed in
5.0.9
What to do
If your site has an affected version, update Essential Addons for Elementor to version 5.0.9 or newer.
Official ID
CVE-2022-0683
Report title
Essential Addons for Elementor Lite <= 5.0.8 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could read or delete private files on your server

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 1.0.0 up to and including 5.0.4
Fixed in
5.0.5
What to do
If your site has an affected version, update Essential Addons for Elementor to version 5.0.5 or newer.
Official ID
CVE-2022-0320
Report title
Essential Addons for Elementor <= 5.0.4 - Local File Inclusion
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 4.6.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.6.4
Fixed in
4.6.5
What to do
If your site has an affected version, update Essential Addons for Elementor to version 4.6.5 or newer.
Official ID
CVE-2021-4446
Report title
Essential Addons for Elementor <= 4.6.4 - Missing Authorization
First reported
Sources
This week

Someone with a contributor account on your site could take over your site as an admin (up to and including 4.6.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.6.4
Fixed in
4.6.5
What to do
If your site has an affected version, update Essential Addons for Elementor to version 4.6.5 or newer.
Official ID
CVE-2021-4447
Report title
Essential Addons for Elementor <= 4.6.4 - Authenticated (Contributor+) Privilege Escalation
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 4.5.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 4.5.4
Fixed in
4.5.4
What to do
If your site has an affected version, update Essential Addons for Elementor to version 4.5.4 or newer.
Official ID
CVE-2021-24255
Report title
Essential Addons for Elementor Lite <= 4.5.3 - Cross-Site Scripting
First reported
Sources

Where this comes from

We collect these reports from public security sources and rewrite them in plain words. Each problem shows its sources and the date we first saw it. This page never says whether your own site is affected: only a check of your site’s versions can tell.

All plugins and themes

Get an email when your site is affected.

Install Watchfox AI once. It checks your plugins and themes against this list every day, for free.

Install Watchfox AI (free)