Is Essential Addons for Elementor safe to use?

Laskyr does not give safety verdicts. No known unpatched vulnerabilities in the latest version (6.8.8). As of 2026-11-01. 74 issues are on record for older versions; version 6.8.8 or newer fixes all of them that state a fix. Keep Essential Addons for Elementor on the latest version (6.8.8) and remove it if you do not use it.

Which versions of Essential Addons for Elementor are vulnerable?

Known issues on record (newest first): Security issue (6.6.0 up to (not including) 6.8.8, fixed in 6.8.8); Privilege escalation (6.8.7 and older, fixed in 6.8.8); Missing authorization check (6.7.3 up to (not including) 6.8.7, fixed in 6.8.7); Information disclosure (older than 6.8.7, fixed in 6.8.7); Security issue (older than 6.8.7, fixed in 6.8.7); Missing authorization check (older than 6.8.7, fixed in 6.8.7). The full list with sources is on this page.

What is the latest version of Essential Addons for Elementor?

6.8.8, according to wordpress.org (last updated 2026-10-28). It has 1+ million active installs.

What should I do if my Essential Addons for Elementor is out of date?

Take a backup, then update it from Dashboard > Updates (or run wp plugin update essential-addons-for-elementor-lite). If you cannot update right away, deactivate it until you can. If you think the site was already attacked, run a free scan at https://laskyr.com/scan.

Plugins · essential-addons-for-elementor-lite · data as of 2026-11-01

Is Essential Addons for Elementor safe? Known vulnerabilities and latest version

Latest version: 6.8.8
Last updated: 2026-10-28
Active installs: 1+ million
Known issues on record: 74
Unpatched in latest: 0
Tested up to WP: 7.1.4 · PHP 7.0+

Elementor addon: 120+ widgets & templates — Elementor Gallery, Mega Menu, Slider, Form, Post Grid, Accordion, Header Footer Builder & WooCommerce. — by WPDeveloper

What to do

Update to the latest version (6.8.8). Anything older than 6.8.8 has at least one known issue listed below. Dashboard → Updates, or Plugins → “update now”.
If you cannot update right away, deactivate it until you can.
Turn on auto-updates for it: Plugins → “Enable auto-updates” on its row.
If you ran a vulnerable version and something looks off (spam pages, strange admins, redirects), run the free scan.

With WP-CLI: wp plugin get essential-addons-for-elementor-lite --field=version shows what you run; wp plugin update essential-addons-for-elementor-lite updates it.

Check your version

Known vulnerabilities

74 on record, newest first. “Affected” is the version range the source gives; “fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version.

not scored yet CVE-2026-110808 · published 2026-10-31

Security issue in Essential Addons for Elementor (6.6.0 up to (not including) 6.8.8)

Affected: 6.6.0 up to (not including) 6.8.8
Fixed in: 6.8.8
Range from: CVE record (the advisory publisher)

Details from the advisory

The Essential Addons for Elementor WordPress plugin before 6.8.8 does not correctly restrict who may set the role assigned to accounts created through its registration form, allowing authenticated users with Author-level access and above to cause newly registered accounts, including those created by unauthenticated visitors through the public registration form, to be granted a higher role such as Editor. This is an incomplete fix of CVE-2026-5193: the role-validation control added in 6.6.0 can be circumvented by a lower-privileged user, so versions 6.6.0 through 6.8.7 remain affected even on sites that are patched against that advisory.

NVD CVE-2026-110808 WPScan advisory

high 7.4 CVE-2026-118205 · published 2026-10-30

Privilege escalation in Essential Addons for Elementor (6.8.7 and older)

Affected: 6.8.7 and older
Fixed in: 6.8.8 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.8.7 via the `page_id` parameter of the `register_user()` function. The vulnerability exists because the handler's post status deny-list rejects `future`, `draft`, and `pending` but admits `inherit` — the status carried by every WordPress revision — allowing an attacker to substitute a revision ID for a live page ID, while a flawed "last saved by administrator" check reads `post_author` on revisions (which reflects the editing administrator) rather than the `_edit_last` meta that is never copied to revisions, and the nonce gate is rendered ineffective because any unauthenticated visitor can freely obtain a valid nonce via the `wp_ajax_nopriv_eael_get_token` endpoint. This makes it possible for unauthenticated attackers to register an account with a role as high as Editor — gaining capabilities including `edit_others_posts`, `publish_pages`, `upload_files`, and `unfiltered_html` — by naming a revision whose `_elementor_data` contains an elevated role an administrator previously saved and later reverted on a page bearing the Login/Register widget. Successful exploitation requires that the site has "Anyone can register" enabled and that an administrator has at some point saved and then reverted a non-default "New User Role" on an affected page.

NVD CVE-2026-118205 Wordfence advisory Code change (fix)Plugin source

medium 5.3 CVE-2026-110508 · published 2026-10-28

Missing authorization check in Essential Addons for Elementor (6.7.3 up to (not including) 6.8.7)

Affected: 6.7.3 up to (not including) 6.8.7
Fixed in: 6.8.7
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by WPScan

Details from the advisory

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not apply its administrator approval requirement to accounts registered through its email one-time-password flow, which could allow unauthenticated users to register and log in without being approved by an administrator when both features are enabled.

NVD CVE-2026-110508 WPScan advisory

medium 5.3 CVE-2026-110509 · published 2026-10-28

Information disclosure in Essential Addons for Elementor (older than 6.8.7)

Affected: older than 6.8.7
Fixed in: 6.8.7
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not restrict the post type or meta query an unauthenticated visitor can pass to its pagination endpoint, which could allow them to read content of non-public post types and recover the values of private custom fields on published posts.

NVD CVE-2026-110509 WPScan advisory

low 3.5 CVE-2026-110510 · published 2026-10-23

Security issue in Essential Addons for Elementor (older than 6.8.7)

Affected: older than 6.8.7
Fixed in: 6.8.7
Access needed (per CVSS): Needs an admin-level account; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widgets before using it to build markup, which could allow users with the author role and above to inject iframe and form elements into published pages.

NVD CVE-2026-110510 WPScan advisory

low 3.8 CVE-2026-110537 · published 2026-10-23

Missing authorization check in Essential Addons for Elementor (older than 6.8.7)

Affected: older than 6.8.7
Fixed in: 6.8.7
Access needed (per CVSS): Needs an admin-level account
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user accounts targeted by its login-approval feature, checking only a site-level capability, which on WordPress Multisite could allow a subsite administrator to change the approval and login state of accounts belonging to other sites on the network.

NVD CVE-2026-110537 WPScan advisory

medium 6.4 CVE-2026-110898 · published 2026-10-19

Privilege escalation in Essential Addons for Elementor (6.8.5 and older)

Affected: 6.8.5 and older
Fixed in: 6.8.6
Access needed (per CVSS): Needs an admin-level account; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Incorrect Privilege Assignment vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Privilege Escalation.This issue affects Essential Addons for Elementor: from n/a through 6.8.5.

NVD CVE-2026-110898 Patchstack advisory

medium 6.5 CVE-2026-102394 · published 2026-10-01

Stored cross-site scripting (XSS) in Essential Addons for Elementor (6.8.4 and older)

Affected: 6.8.4 and older
Fixed in: 6.8.5
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through 6.8.4.

NVD CVE-2026-102394 Patchstack advisory

medium 5.3 CVE-2026-81777 · published 2026-08-28

Authentication bypass in Essential Addons for Elementor (6.8.0 and older)

Affected: 6.8.0 and older
Fixed in: 6.8.1
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Authentication Bypass by Spoofing vulnerability in WPDeveloper Essential Addons for Elementor allows Identity Spoofing. This issue affects Essential Addons for Elementor: from n/a through 6.8.0.

NVD CVE-2026-81777 Patchstack advisory

high 8.1 CVE-2026-18039 · published 2026-08-14

Privilege escalation in Essential Addons for Elementor (5.8.6 up to (not including) 6.7.2)

Affected: 5.8.6 up to (not including) 6.7.2
Fixed in: 6.7.2
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration fields from overwriting reserved account attributes, allowing unauthenticated attackers to register an account with an arbitrary role, including administrator, on sites where a custom profile field with a particular label has been configured.

NVD CVE-2026-18039 WPScan advisory

medium 4.8 CVE-2026-13344 · published 2026-07-30

Stored cross-site scripting (XSS) in Essential Addons for Elementor (older than 6.6.10)

Affected: older than 6.6.10
Fixed in: 6.6.10
Access needed (per CVSS): Needs an admin-level account; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The Essential Addons for Elementor WordPress plugin before 6.6.10 does not validate the HTML tag name of the Pricing Table widget title before outputting it, allowing users with Contributor-level access and above to inject JavaScript that will be executed (Stored Cross-Site Scripting) when the page is viewed, including in the session of an administrator previewing or visiting the post.

NVD CVE-2026-13344 WPScan advisory

medium 5.3 CVE-2026-13345 · published 2026-07-30

Missing authorization check in Essential Addons for Elementor (older than 6.6.10)

Affected: older than 6.6.10
Fixed in: 6.6.10
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The Essential Addons for Elementor WordPress plugin before 6.6.10 does not perform authorization, status, or visibility checks when resolving WooCommerce products in its product-comparison feature, allowing unauthenticated users to disclose the title, price, and SKU of draft, pending, and private products that are otherwise withheld from public view.

NVD CVE-2026-13345 WPScan advisory

medium 6.4 CVE-2026-15145 · published 2026-07-21

Stored cross-site scripting (XSS) in Essential Addons for Elementor (6.6.11 and older)

Affected: 6.6.11 and older
Fixed in: 6.7.0 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Fancy Text Widget in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2026-15145 Wordfence advisory Code change (fix)github.com Plugin source

medium 6.4 CVE-2026-15156 · published 2026-07-21

Stored cross-site scripting (XSS) in Essential Addons for Elementor (6.6.11 and older)

Affected: 6.6.11 and older
Fixed in: 6.7.0 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Reading Progress Global Color Settings in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2026-15156 Wordfence advisory Code change (fix)Plugin source

high 8.8 CVE-2026-15155 · published 2026-07-11

Weak password recovery in Essential Addons for Elementor (6.6.10 and older)

Affected: 6.6.10 and older
Fixed in: 6.6.11 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Authenticated Account Takeover via Email Header Injection in all versions up to, and including, 6.6.10 This is due to insufficient server-side validation of a Login/Register widget setting used to construct outgoing email headers — the allowed-values restriction is enforced only in the client-side editor UI and not on the server, and the applied sanitization does not strip or encode CR/LF characters, allowing CRLF sequences stored in that setting to survive into raw mail headers. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject an additional Bcc header into the WordPress administrator's password-reset notification email, receive a copy of a valid administrator password-reset link, and achieve full administrator account takeover.

NVD CVE-2026-15155 Wordfence advisory Code change (fix)Plugin source

medium 6.4 CVE-2026-6459 · published 2026-07-08

Stored cross-site scripting (XSS) in Essential Addons for Elementor (6.6.2 and older)

Affected: 6.6.2 and older
Fixed in: 6.6.3 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Event Calendar widget in all versions up to, and including, 6.6.2 due to insufficient input sanitization and output escaping on event titles sourced from The Events Calendar. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2026-6459 Wordfence advisory Code change (fix)research.cleantalk.org

medium 5.3 CVE-2026-25440 · published 2026-06-15

Missing authorization check in Essential Addons for Elementor (older than 6.6.0)

Affected: older than 6.6.0
Fixed in: 6.6.0
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Unauthenticated Broken Access Control in Essential Addons for Elementor < 6.6.0 versions.

NVD CVE-2026-25440 Patchstack advisory

medium 5.3 CVE-2026-7665 · published 2026-06-06

Information disclosure in Essential Addons for Elementor (6.6.4 and older)

Affected: 6.6.4 and older
Fixed in: 6.6.5 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.6.4 via the ajax_load_more function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

NVD CVE-2026-7665 Wordfence advisory Code change (fix)Plugin source

medium 6.5 CVE-2026-5193 · published 2026-05-14

Privilege escalation in Essential Addons for Elementor (6.5.13 and older)

Affected: 6.5.13 and older
Fixed in: 6.6.0 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 6.5.13. This is due to insufficient role validation in the 'register_user' function, which only blocks the 'administrator' role. This makes it possible for authenticated attackers, with author level access and above, to create new user accounts with elevated privileges such as editor.

NVD CVE-2026-5193 Wordfence advisory Code change (fix)

medium 5.3 CVE-2026-23543 · published 2026-02-19

Missing authorization check in Essential Addons for Elementor (6.5.5 and older)

Affected: 6.5.5 and older
Fixed in: 6.5.6
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Missing Authorization vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Addons for Elementor: from n/a through <= 6.5.5.

NVD CVE-2026-23543 Patchstack advisory

medium 6.4 CVE-2026-1512 · published 2026-02-14

Stored cross-site scripting (XSS) in Essential Addons for Elementor (6.5.9 and older)

Affected: 6.5.9 and older
Fixed in: 6.5.10 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Info Box widget in all versions up to, and including, 6.5.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2026-1512 Wordfence advisory Code change (fix)

medium 5.3 CVE-2026-1004 · published 2026-01-16

Information disclosure in Essential Addons for Elementor (6.5.5 and older)

Affected: 6.5.5 and older
Fixed in: 6.5.6 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Essential Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 6.5.5 via the 'eael_product_quickview_popup' function. This makes it possible for unauthenticated attackers to retrieve WooCommerce product information for products with draft, pending, or private status, which should normally be restricted.

NVD CVE-2026-1004 Wordfence advisory github.com Plugin source

medium 6.5 CVE-2025-69092 · published 2025-12-30

Cross-site scripting (XSS) in Essential Addons for Elementor (6.5.3 and older)

Affected: 6.5.3 and older
Fixed in: 6.5.4
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows DOM-Based XSS.This issue affects Essential Addons for Elementor: from n/a through <= 6.5.3.

NVD CVE-2025-69092 Patchstack advisory

medium 6.4 CVE-2025-13977 · published 2025-12-17

Stored cross-site scripting (XSS) in Essential Addons for Elementor (6.5.3 and older)

Affected: 6.5.3 and older
Fixed in: 6.5.4 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple attack vectors in all versions up to, and including, 6.5.3. This is due to insufficient input sanitization and output escaping in the Event Calendar widget's custom attributes handling and the Image Masking module's element ID rendering. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2025-13977 Wordfence advisory Code change (fix)Plugin source

low 2.7 CVE-2025-64352 · published 2025-10-31

Missing authorization check in Essential Addons for Elementor (6.2.4 and older)

Affected: 6.2.4 and older
Fixed in: 6.3.0
Access needed (per CVSS): Needs an admin-level account
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

NVD CVE-2025-64352 Patchstack advisory

medium 6.4 CVE-2025-8451 · published 2025-08-15

Stored cross-site scripting (XSS) in Essential Addons for Elementor (6.2.2 and older)

Affected: 6.2.2 and older
Fixed in: 6.2.3 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘data-gallery-items’ parameter in all versions up to, and including, 6.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2025-8451 Wordfence advisory Code change (fix)Plugin source

medium 5.4 CVE-2025-6244 · published 2025-07-08

Stored cross-site scripting (XSS) in Essential Addons for Elementor (6.1.19 and older)

Affected: 6.1.19 and older
Fixed in: 6.1.20 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Essential Addons for Elementor – Popular Elementor Templates and Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the via `Calendar` And `Business Reviews` Widgets attributes in all versions up to, and including, 6.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2025-6244 Wordfence advisory Code change (fix)

medium 5.4 CVE-2024-9994 · published 2025-06-07

Stored cross-site scripting (XSS) in Essential Addons for Elementor (6.1.12 and older)

Affected: 6.1.12 and older
Fixed in: 6.1.13 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the eael_pricing_item_tooltip_content parameter of the Pricing Table Widget in all versions up to, and including, 6.1.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-9994 Wordfence advisory Plugin source

medium 5.4 CVE-2024-9993 · published 2025-06-07

Stored cross-site scripting (XSS) in Essential Addons for Elementor (6.1.12 and older)

Affected: 6.1.12 and older
Fixed in: 6.1.13 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the eael_event_details_text parameter of Event Calendar Widget in all versions up to, and including, 6.1.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-9993 Wordfence advisory Plugin source

medium 6.1 CVE-2025-24752 · published 2025-04-17

Reflected cross-site scripting (XSS) in Essential Addons for Elementor (6.0.14 and older)

Affected: 6.0.14 and older
Fixed in: 6.0.15
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Reflected XSS.This issue affects Essential Addons for Elementor: from n/a through <= 6.0.14.

NVD CVE-2025-24752 Patchstack advisory

Show 44 older records

medium 4.3 CVE-2025-39589 · published 2025-04-16

Information disclosure in Essential Addons for Elementor (6.1.9 and older)

Affected: 6.1.9 and older
Fixed in: 6.1.10
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Retrieve Embedded Sensitive Data.This issue affects Essential Addons for Elementor: from n/a through <= 6.1.9.

NVD CVE-2025-39589 Patchstack advisory

medium 6.5 CVE-2025-39590 · published 2025-04-16

Stored cross-site scripting (XSS) in Essential Addons for Elementor (6.1.9 and older)

Affected: 6.1.9 and older
Fixed in: 6.1.10
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

NVD CVE-2025-39590 Patchstack advisory

medium 5.4 CVE-2024-56063 · published 2024-12-31

Stored cross-site scripting (XSS) in Essential Addons for Elementor (6.0.7 and older)

Affected: 6.0.7 and older
Fixed in: 6.0.8
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

NVD CVE-2024-56063 Patchstack advisory

medium 5.7 CVE-2024-8979 · published 2024-11-15

Information disclosure in Essential Addons for Elementor (6.0.9 and older)

Affected: 6.0.9 and older
Fixed in: 6.0.10 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.9 via the 'init_content_lostpassword_user_email_controls' function. This makes it possible for authenticated attackers, with Author-level access and above, to extract sensitive data including usernames and passwords of any user, including Administrators, as long as that user opens the email notification for a password change request and images are not blocked by the email client.

NVD CVE-2024-8979 Wordfence advisory Code change (fix)Plugin source

medium 5.7 CVE-2024-8978 · published 2024-11-15

Information disclosure in Essential Addons for Elementor (6.0.9 and older)

Affected: 6.0.9 and older
Fixed in: 6.0.10 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.9 via the 'init_content_register_user_email_controls' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including usernames and passwords of any users who register via the Login | Register Form widget, as long as that user opens the email notification for successful registration.

NVD CVE-2024-8978 Wordfence advisory Code change (fix)Plugin source

medium 5.4 CVE-2024-8961 · published 2024-11-15

Stored cross-site scripting (XSS) in Essential Addons for Elementor (6.0.7 and older)

Affected: 6.0.7 and older
Fixed in: 6.0.8 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘nomore_items_text’ parameter in all versions up to, and including, 6.0.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-8961 Wordfence advisory Code change (fix)Plugin source

medium 4.3 CVE-2021-4446 · published 2024-10-16

Missing authorization check in Essential Addons for Elementor (4.6.4 and older)

Affected: 4.6.4 and older
Fixed in: 4.6.5 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Essential Addons for Elementor plugin for WordPress is vulnerable to authorization bypass in versions up to and including 4.6.4 due to missing capability checks and nonce disclosure. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to perform many unauthorized actions such as changing settings and installing arbitrary plugins.

NVD CVE-2021-4446 Wordfence advisory Code change (fix)

high 8.8 CVE-2021-4447 · published 2024-10-16

Privilege escalation in Essential Addons for Elementor (4.6.4 and older)

Affected: 4.6.4 and older
Fixed in: 4.6.5 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Essential Addons for Elementor plugin for WordPress is vulnerable to privilege escalation in versions up to and including 4.6.4 due to a lack of restrictions on who can add a registration form and a custom registration role to an Elementor created page. This makes it possible for attackers with access to the Elementor page builder to create a new registration form that defaults to the user role being set to administrator and subsequently register as an administrative user.

NVD CVE-2021-4447 Wordfence advisory Code change (fix)

medium 5.4 CVE-2024-8742 · published 2024-09-13

Stored cross-site scripting (XSS) in Essential Addons for Elementor (6.0.3 and older)

Affected: 6.0.3 and older
Fixed in: 6.0.4 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Filterable Gallery widget in all versions up to, and including, 6.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-8742 Wordfence advisory Code change (fix)wordpress.org Plugin source

medium 5.4 CVE-2024-8440 · published 2024-09-11

Stored cross-site scripting (XSS) in Essential Addons for Elementor (6.0.3 and older)

Affected: 6.0.3 and older
Fixed in: 6.0.4 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Fancy Text widget in all versions up to, and including, 6.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-8440 Wordfence advisory Code change (fix)wordpress.org Plugin source

medium 5.4 CVE-2024-7092 · published 2024-08-13

Stored cross-site scripting (XSS) in Essential Addons for Elementor (5.9.27 and older)

Affected: 5.9.27 and older
Fixed in: 6.0.0 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘no_more_items_text’ parameter in all versions up to, and including, 5.9.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-7092 Wordfence advisory Code change (fix)wordpress.org essential-addons.com Plugin source

medium 5.4 CVE-2024-39649 · published 2024-08-01

Cross-site scripting (XSS) in Essential Addons for Elementor (5.9.26 and older)

Affected: 5.9.26 and older
Fixed in: 5.9.27
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite.This issue affects Essential Addons for Elementor: from n/a through <= 5.9.26.

NVD CVE-2024-39649 Patchstack advisory

medium 5.4 CVE-2024-5189 · published 2024-06-11

Stored cross-site scripting (XSS) in Essential Addons for Elementor (5.9.23 and older)

Affected: 5.9.23 and older
Fixed in: 5.9.24 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘custom_js’ parameter in all versions up to, and including, 5.9.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-5189 Wordfence advisory Code change (fix)Plugin source

medium 5.4 CVE-2024-5188 · published 2024-06-06

Stored cross-site scripting (XSS) in Essential Addons for Elementor (5.9.22 and older)

Affected: 5.9.22 and older
Fixed in: 5.9.23 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'get_manual_calendar_events' function in all versions up to, and including, 5.9.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-5188 Wordfence advisory Code change (fix)Plugin source

medium 5.4 CVE-2024-5073 · published 2024-05-30

Stored cross-site scripting (XSS) in Essential Addons for Elementor (5.9.21 and older)

Affected: 5.9.21 and older
Fixed in: 5.9.22 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Twitter Feed component in all versions up to, and including, 5.9.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-5073 Wordfence advisory Code change (fix)wordpress.org Plugin source

high 8.8 CVE-2023-41955 · published 2024-05-17

Privilege escalation in Essential Addons for Elementor (5.8.8 and older)

Affected: 5.8.8 and older
Fixed in: 5.8.9
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Improper Privilege Management vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation.This issue affects Essential Addons for Elementor: from n/a through 5.8.8.

NVD CVE-2023-41955 Patchstack advisory

medium 5.4 CVE-2024-4624 · published 2024-05-14

Stored cross-site scripting (XSS) in Essential Addons for Elementor (5.9.20 and older)

Affected: 5.9.20 and older
Fixed in: 5.9.21 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugins for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eael_ext_toc_title_tag’ parameter in versions up to, and including, 5.9.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-4624 Wordfence advisory Code change (fix)Plugin source

medium 5.4 CVE-2024-4449 · published 2024-05-14

Stored cross-site scripting (XSS) in Essential Addons for Elementor (5.9.19 and older)

Affected: 5.9.19 and older
Fixed in: 5.9.20 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Fancy Text', 'Filter Gallery', 'Sticky Video', 'Content Ticker', 'Woo Product Gallery', & 'Twitter Feed' widgets in all versions up to, and including, 5.9.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-4449 Wordfence advisory Code change (fix)

medium 6.4 CVE-2024-4448 · published 2024-05-14

Stored cross-site scripting (XSS) in Essential Addons for Elementor (5.9.19 and older)

Affected: 5.9.19 and older
Fixed in: 5.9.20 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Dual Color Header', 'Event Calendar', & 'Advanced Data Table' widgets in all versions up to, and including, 5.9.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-4448 Wordfence advisory Code change (fix)

medium 5.4 CVE-2024-4275 · published 2024-05-14

Stored cross-site scripting (XSS) in Essential Addons for Elementor (5.9.19 and older)

Affected: 5.9.19 and older
Fixed in: 5.9.20 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Interactive Circle widget in all versions up to, and including, 5.9.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-4275 Wordfence advisory Code change (fix)

medium 5.4 CVE-2024-4156 · published 2024-05-02

Stored cross-site scripting (XSS) in Essential Addons for Elementor (5.9.17 and older)

Affected: 5.9.17 and older
Fixed in: 5.9.18 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eael_event_text_color’ parameter in versions up to, and including, 5.9.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-4156 Wordfence advisory Code change (fix)Plugin source

medium 5.4 CVE-2024-4003 · published 2024-05-02

Stored cross-site scripting (XSS) in Essential Addons for Elementor (5.9.15 and older)

Affected: 5.9.15 and older
Fixed in: 5.9.16 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the eael_team_members_image_rounded parameter in the Team Members widget in all versions up to, and including, 5.9.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-4003 Wordfence advisory Code change (fix)

medium 6.4 CVE-2024-3728 · published 2024-05-02

Stored cross-site scripting (XSS) in Essential Addons for Elementor (5.9.15 and older)

Affected: 5.9.15 and older
Fixed in: 5.9.16 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Filterable Gallery & Interactive Circle widgets in all versions up to, and including, 5.9.15 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-3728 Wordfence advisory Code change (fix)

medium 5.3 CVE-2024-3733 · published 2024-04-25

Information disclosure in Essential Addons for Elementor (5.9.15 and older)

Affected: 5.9.15 and older
Fixed in: 5.9.16 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.9.15 via the ajax_load_more() , eael_woo_pagination_product_ajax(), and ajax_eael_product_gallery() functions. This makes it possible for unauthenticated attackers to extract posts that may be in private or draft status.

NVD CVE-2024-3733 Wordfence advisory Code change (fix)

medium 6.4 CVE-2024-3333 · published 2024-04-17

Stored cross-site scripting (XSS) in Essential Addons for Elementor (5.9.14 and older)

Affected: 5.9.14 and older
Fixed in: 5.9.15 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Essential Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attributes of widgets in all versions up to, and including, 5.9.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-3333 Wordfence advisory Code change (fix)

medium 5.3 CVE-2024-2974 · published 2024-04-09

Information disclosure in Essential Addons for Elementor (5.9.13 and older)

Affected: 5.9.13 and older
Fixed in: 5.9.14 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 5.9.13 via the load_more function. This can allow unauthenticated attackers to extract sensitive data including private and draft posts.

NVD CVE-2024-2974 Wordfence advisory Code change (fix)

medium 6.4 CVE-2024-2623 · published 2024-04-09

Stored cross-site scripting (XSS) in Essential Addons for Elementor (5.9.11 and older)

Affected: 5.9.11 and older
Fixed in: 5.9.12 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the countdown widget's message parameter in all versions up to, and including, 5.9.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-2623 Wordfence advisory Code change (fix)Plugin source

medium 6.4 CVE-2024-2650 · published 2024-04-09

Stored cross-site scripting (XSS) in Essential Addons for Elementor (5.9.11 and older)

Affected: 5.9.11 and older
Fixed in: 5.9.12 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the alignment parameter in the Woo Product Carousel widget in all versions up to, and including, 5.9.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-2650 Wordfence advisory Code change (fix)

high 8.8 CVE-2024-3018 · published 2024-03-30

PHP object injection in Essential Addons for Elementor (5.9.13 and older)

Affected: 5.9.13 and older
Fixed in: 5.9.14 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Essential Addons for Elementor plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.9.13 via deserialization of untrusted input from the 'error_resetpassword' attribute of the "Login | Register Form" widget (disabled by default). This makes it possible for authenticated attackers, with author-level access and above, to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

NVD CVE-2024-3018 Wordfence advisory Code change (fix)

high 7.4 CVE-2024-1536 · published 2024-03-13

Stored cross-site scripting (XSS) in Essential Addons for Elementor (5.9.9 and older)

Affected: 5.9.9 and older
Fixed in: 5.9.10 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's event calendar widget in all versions up to, and including, 5.9.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-1536 Wordfence advisory Code change (fix)

medium 6.4 CVE-2024-1537 · published 2024-03-13

Stored cross-site scripting (XSS) in Essential Addons for Elementor (5.9.9 and older)

Affected: 5.9.9 and older
Fixed in: 5.9.10 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Data Table widget in all versions up to, and including, 5.9.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-1537 Wordfence advisory Code change (fix)

medium 6.4 CVE-2024-1276 · published 2024-02-29

Stored cross-site scripting (XSS) in Essential Addons for Elementor (5.9.8 and older)

Affected: 5.9.8 and older
Fixed in: 5.9.9 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Content Ticker arrow attribute in all versions up to, and including, 5.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-1276 Wordfence advisory Code change (fix)Plugin source

medium 6.4 CVE-2024-1236 · published 2024-02-29

Stored cross-site scripting (XSS) in Essential Addons for Elementor (5.9.8 and older)

Affected: 5.9.8 and older
Fixed in: 5.9.9 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Filterable Controls label icon parameter in all versions up to, and including, 5.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-1236 Wordfence advisory Code change (fix)Plugin source

medium 5.4 CVE-2024-1171 · published 2024-02-29

Stored cross-site scripting (XSS) in Essential Addons for Elementor (5.9.8 and older)

Affected: 5.9.8 and older
Fixed in: 5.9.9 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Filterable Gallery Widget in all versions up to, and including, 5.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-1171 Wordfence advisory Code change (fix)

medium 5.4 CVE-2024-1172 · published 2024-02-29

Stored cross-site scripting (XSS) in Essential Addons for Elementor (5.9.8 and older)

Affected: 5.9.8 and older
Fixed in: 5.9.9 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Accordion widget in all versions up to, and including, 5.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-1172 Wordfence advisory Code change (fix)Plugin source

medium 5.4 CVE-2024-0954 · published 2024-02-05

Stored cross-site scripting (XSS) in Essential Addons for Elementor (5.9.7 and older)

Affected: 5.9.7 and older
Fixed in: 5.9.8 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting through editing context via the 'data-eael-wrapper-link' wrapper in all versions up to, and including, 5.9.7 due to insufficient input sanitization and output escaping on user supplied protocols. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-0954 Wordfence advisory Code change (fix)

medium 5.4 CVE-2024-0585 · published 2024-02-05

Stored cross-site scripting (XSS) in Essential Addons for Elementor (5.9.4 and older)

Affected: 5.9.4 and older
Fixed in: 5.9.5 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Filterable Gallery widget in all versions up to, and including, 5.9.4 due to insufficient input sanitization and output escaping on the Image URL. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-0585 Wordfence advisory Code change (fix)

medium 6.4 CVE-2024-0586 · published 2024-02-05

Stored cross-site scripting (XSS) in Essential Addons for Elementor (5.9.4 and older)

Affected: 5.9.4 and older
Fixed in: 5.9.5 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Login/Register Element in all versions up to, and including, 5.9.4 due to insufficient input sanitization and output escaping on the custom login URL. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-0586 Wordfence advisory Code change (fix)

medium 5.4 CVE-2023-7044 · published 2024-01-04

Stored cross-site scripting (XSS) in Essential Addons for Elementor (5.9.2 and older)

Affected: 5.9.2 and older
Fixed in: 5.9.3 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom ID in all versions up to, and including, 5.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor access and higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2023-7044 Wordfence advisory Code change (fix)Plugin source

medium 5.3 CVE-2023-3779 · published 2023-07-20

Information disclosure in Essential Addons for Elementor (5.8.1 and older)

Affected: 5.8.1 and older
Fixed in: 5.8.2 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Essential Addons For Elementor plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 5.8.1 due to the plugin adding the API key to the source code of any page running the MailChimp block. This makes it possible for unauthenticated attackers to obtain a site's MailChimp API key. We recommend resetting any MailChimp API keys if running a vulnerable version of this plugin with the MailChimp block enabled as the API key may have been compromised. This only affects sites running the premium version of the plugin and that have the Mailchimp block enabled on a page.

NVD CVE-2023-3779 Wordfence advisory Code change (fix)

critical 9.8 CVE-2023-32243 · published 2023-05-12

Privilege escalation in Essential Addons for Elementor (5.4.0 to 5.7.1)

Affected: 5.4.0 to 5.7.1
Fixed in: 5.7.2
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Improper Authentication vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation. This issue affects Essential Addons for Elementor: from 5.4.0 through 5.7.1.

NVD CVE-2023-32243 Patchstack advisory packetstormsecurity.com Patchstack advisory

medium 6.1 CVE-2022-0683 · published 2022-02-24

Cross-site scripting (XSS) in Essential Addons for Elementor (5.0.8 to 5.0.8)

Affected: 5.0.8 to 5.0.8
Fixed in: 5.0.9 *
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Essential Addons for Elementor Lite WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the settings parameter found in the ~/includes/Traits/Helper.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever a user clicks on a specially crafted link by an attacker. This affects versions up to and including 5.0.8.

NVD CVE-2022-0683 Code change (fix)Wordfence advisory

critical 9.8 CVE-2022-0320 · published 2022-02-01

Remote code execution in Essential Addons for Elementor (older than 5.0.5)

Affected: older than 5.0.5
Fixed in: 5.0.5
Access needed (per CVSS): No login needed
Range from: advisory text · score by NVD

Details from the advisory

The Essential Addons for Elementor WordPress plugin before 5.0.5 does not validate and sanitise some template data before it them in include statements, which could allow unauthenticated attackers to perform Local File Inclusion attack and read arbitrary files on the server, this could also lead to RCE via user uploaded files or other LFI to RCE techniques.

NVD CVE-2022-0320 WPScan advisory

medium 5.4 CVE-2021-24255 · published 2021-05-05

Stored cross-site scripting (XSS) in Essential Addons for Elementor (older than 4.5.4)

Affected: older than 4.5.4
Fixed in: 4.5.4
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: advisory text · score by NVD

Details from the advisory

The Essential Addons for Elementor Lite WordPress Plugin before 4.5.4 has two widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, both via a similar method.

NVD CVE-2021-24255 WPScan advisory Wordfence advisory

Recent activity

2026-10-28 — latest release on wordpress.org (6.8.8).
2026-10-31 — Security issue disclosed (CVE-2026-110808), fixed in 6.8.8.
2026-10-30 — Privilege escalation disclosed (CVE-2026-118205), fixed in 6.8.8.
2026-10-28 — Missing authorization check disclosed (CVE-2026-110508), fixed in 6.8.7.

Free. We check the CVE feeds every day and email you only when a new issue for Essential Addons for Elementor (essential-addons-for-elementor-lite) is published or a fix ships. Unsubscribe in one click.

Where this data comes from

Version, last update, installs: wordpress.org/plugins/essential-addons-for-elementor-lite (Plugins API), fetched 2026-11-01.
Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-01. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Each record links to its CVE page and to the original advisory (Wordfence, Patchstack or WPScan) where there is one. We only list a CVE here when its references or its advisory name this exact plugin, so a few real issues may be missing; none should be about a different plugin. Spot an error? Email Daniel.

Badge for your site or docs (states facts with a date, not a verdict):

<a href="https://laskyr.com/plugins/essential-addons-for-elementor-lite"><img src="https://laskyr.com/plugins/essential-addons-for-elementor-lite/badge.svg" alt="Essential Addons for Elementor vulnerability status"></a>

← Check another plugin · Free hacked-site scan